[Test Coverage] container-lifecycle.ts#6396
Conversation
Covers startContainers, runAgentCommand, and fastKillAgentContainer: - Success paths and error delegation to handleHealthcheckError - Retry logic for api-proxy and squid transient startup failures - cli-proxy failure error with DNS detail - Topology mode onNetworkReady callback - Timeout exit code (124) and external kill (143) - Blocked domain reporting - fastKillAgentContainer custom timeout and error tolerance Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (2 files)
Coverage comparison generated by |
There was a problem hiding this comment.
Pull request overview
Adds mocked unit coverage for Docker container lifecycle behavior.
Changes:
- Tests startup, retry, timeout, exit-code, and fast-kill paths.
- Adds coverage for cli-proxy DNS diagnostics.
Show a summary per file
| File | Description |
|---|---|
src/container-lifecycle.test.ts |
Adds lifecycle unit tests with mocked dependencies. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 4
- Review effort level: Medium
| * Unit tests for container-lifecycle.ts | ||
| * | ||
| * Covers: startContainers, runAgentCommand, fastKillAgentContainer | ||
| * Uses jest.mock() for all Docker/execa/fs dependencies. |
| const result = await runAgentCommand(WORK_DIR, ['github.com']); | ||
| expect(result.exitCode).toBe(1); | ||
| expect(result.blockedDomains).toEqual(['evil.com']); |
| jest.useFakeTimers(); | ||
| const resultPromise = runAgentCommand(WORK_DIR, [], undefined, 0.001); | ||
| await jest.runAllTimersAsync(); | ||
| const result = await resultPromise; | ||
| jest.useRealTimers(); | ||
|
|
||
| expect(result.exitCode).toBe(124); |
| import { isAgentExternallyKilled, markAgentExternallyKilled, containerLifecycleStateTestHelpers } from './container-lifecycle-state'; | ||
|
|
||
| const mockDidContainerFailStartup = didContainerFailStartup as jest.MockedFunction<typeof didContainerFailStartup>; | ||
| const mockHandleHealthcheckError = handleHealthcheckError as jest.MockedFunction<typeof handleHealthcheckError>; | ||
| const mockLogContainerLogsToStderr = logContainerLogsToStderr as jest.MockedFunction<typeof logContainerLogsToStderr>; | ||
| const mockDetectDnsResolutionFailure = detectDnsResolutionFailure as jest.MockedFunction<typeof detectDnsResolutionFailure>; | ||
| const mockCheckSquidLogs = checkSquidLogs as jest.MockedFunction<typeof checkSquidLogs>; | ||
| const mockRunComposeDown = runComposeDown as jest.MockedFunction<typeof runComposeDown>; | ||
| const mockIsAgentExternallyKilled = isAgentExternallyKilled as jest.MockedFunction<typeof isAgentExternallyKilled>; | ||
| const mockMarkAgentExternallyKilled = markAgentExternallyKilled as jest.MockedFunction<typeof markAgentExternallyKilled>; | ||
|
|
||
| const WORK_DIR = '/tmp/awf-test'; | ||
|
|
||
| beforeEach(() => { | ||
| jest.resetAllMocks(); | ||
| containerLifecycleStateTestHelpers.resetAgentExternallyKilled(); |
|
@copilot address review feedback |
Addressed in
|
|
✅ Smoke Gemini completed. All facets verified. 💎 Smoke test completed with FAIL status due to connectivity issues. |
|
🔌 Smoke Services — All services reachable! ✅ |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤 |
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓 |
|
🚀 Security Guard has started processing this pull request |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
✅ Contribution Check completed successfully! PR #6396 meets the applicable CONTRIBUTING.md guidelines; no comment needed. |
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ |
|
🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅ |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
✅ Build Test Suite completed successfully! |
|
✅ Smoke Claude passed |
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓 |
🔬 Smoke Test Results
Overall: PASS (MCP reachable; pre-step template vars not expanded into prompt) cc Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
|
Smoke test: Copilot network-isolation egress EGRESS_RESULT allow=pass deny=pass ✅ Test 1 (allowed domain Overall: PASS — Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"
- "example.com"See Network Configuration for more information.
|
Smoke Test Results
Overall status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
github-actions
Bot
added
smoke-copilot-network-isolation
|
Smoke Test: Copilot BYOK (Direct Mode) ✅ PASS
Running in direct BYOK mode via COPILOT_PROVIDER_API_KEY with api-proxy sidecar injection. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test: Copilot PAT Auth
Overall: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test: Claude Engine Validation
Overall Result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test Results
Overall: FAIL — service containers not reachable from this runner environment. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Chroot Version Comparison
Go versions match; Python and Node.js versions differ between host and chroot. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
|
Smoke test results:
Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
GitHub MCP connectivity: ✅ Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
OTEL Smoke Test Results
Overall: ✅ All implemented scenarios pass; no unexpected failures. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
|
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
🔥 Smoke Test Results
Overall: cc
|
Summary
Adds 20 unit tests for
src/container-lifecycle.ts, a security-critical file with <20% coverage that manages Docker container lifecycle for the AWF firewall.Coverage added
startContainers--pull neverflaghandleHealthcheckErrorwhen no specific container failedawf-api-proxyandawf-squidstartup failuresawf-cli-proxyfailure with specific error messageonNetworkReadycallback invocationrunAgentCommandfastKillAgentContainerApproach
All tests use
jest.mock()for execa, Docker, and dependency modules — no real Docker or iptables calls.Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
awmgmcpgSee Network Configuration for more information.