[Test Coverage] Add test coverage for build-config and predownload commands by github-actions[bot] · Pull Request #3455 · github/gh-aw-firewall

github-actions · 2026-05-20T09:21:48Z

Summary

Adds focused test coverage for two previously under-covered source files:

1. `src/commands/build-config.ts` — 0% → ~95% coverage

This file was entirely uncovered (0% functions, 0% branches). The buildConfig() function is the central config assembly point that:

Reads API keys directly from process.env (security-sensitive)
Applies conditional logic for blockedDomains, additionalEnv, excludeEnv, tty, diagnosticLogs
Falls back to environment variables for audit dirs and API targets

New test file: src/commands/build-config.test.ts covering:

blockedDomains set to undefined when empty (vs populated when non-empty)
additionalEnv set to undefined when empty (vs populated when non-empty)
excludeEnv conditional handling (undefined/empty vs non-empty)
tty and diagnosticLogs default-to-false fallback
API key resolution from process.env: OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY, copilotApiKey via resolveCopilotApiKey()
githubToken: GITHUB_TOKEN takes precedence over GH_TOKEN
auditDir/sessionStateDir env var fallbacks (AWF_AUDIT_DIR, AWF_SESSION_STATE_DIR)
API target env var fallbacks (OPENAI_API_TARGET, ANTHROPIC_API_TARGET, GEMINI_API_TARGET)
Pass-through fields: volumeMounts, upstreamProxy, dnsServers, dockerHostPathPrefix, modelAliases, resolvedCopilotApiTarget

2. `src/commands/predownload.ts` — +4 branch coverage tests

Existing tests were missing coverage for:

act preset → pulls agent-act image (vs agent)
Custom non-preset image → used as-is
validateImageReference: image starting with - throws
validateImageReference: image with whitespace throws

Coverage Impact

File	Before	After (estimated)
`build-config.ts` statements	50% (2/4)	~100%
`build-config.ts` functions	0% (0/1)	100%
`build-config.ts` branches	0% (0/30)	~90%+
`predownload.ts` branches	61.11%	~78%+

Security Coverage Added

API key isolation: tests verify each key is read from the correct env var and resolveCopilotApiKey() is called with process.env
Token precedence: GITHUB_TOKEN over GH_TOKEN is now explicitly tested
Input validation: validateImageReference error paths for injection-style inputs (dash prefix, whitespace) are now covered
Secret redaction surface: the buildConfig function is what feeds credentials into WrapperConfig — having tests here surfaces any accidental credential routing changes

No Bugs Found

No bugs were discovered in the covered code paths during test authoring.

Generated by Test Coverage Improver · ● 26.7M · ◷

- Add src/commands/build-config.test.ts: covers buildConfig() function which was 0% functions / 0% branches. Tests cover: - blockedDomains / additionalEnv / excludeEnv conditional handling - tty and diagnosticLogs default-false fallback - API key resolution from process.env (openai, anthropic, gemini, copilot) - githubToken GITHUB_TOKEN vs GH_TOKEN precedence - auditDir / sessionStateDir env var fallbacks - API target env var fallbacks (openai, anthropic, gemini) - Pass-through fields (volumeMounts, upstreamProxy, dnsServers, etc.) - Extend src/commands/predownload.test.ts: cover validateImageReference branches and the 'act' preset image path: - act preset pulls agent-act image - custom image reference used as-is - image starting with '-' throws validation error - image with whitespace throws validation error Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-20T13:54:47Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	95.53%	95.80%	📈 +0.27%
Statements	95.37%	95.63%	📈 +0.26%
Functions	96.41%	96.86%	📈 +0.45%
Branches	87.91%	89.46%	📈 +1.55%

📁 Per-file Coverage Changes (3 files)

File	Lines (Before → After)	Statements (Before → After)
`src/config-writer.ts`	83.0% → 85.6% (+2.54%)	83.0% → 85.6% (+2.54%)
`src/commands/predownload.ts`	85.4% → 100.0% (+14.64%)	85.4% → 100.0% (+14.64%)
`src/commands/build-config.ts`	50.0% → 100.0% (+50.00%)	50.0% → 100.0% (+50.00%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Adds unit tests to improve coverage for configuration assembly (buildConfig) and Docker image predownload behavior, increasing confidence in env-driven config and image reference validation.

Changes:

Added src/commands/build-config.test.ts to cover env var resolution, option fallbacks, and pass-through fields in buildConfig().
Extended src/commands/predownload.test.ts to cover the act preset image selection, custom image refs, and invalid image reference rejection paths.

Show a summary per file

File	Description
src/commands/build-config.test.ts	New unit tests for `buildConfig()` covering env var resolution, fallbacks, and passthrough behavior.
src/commands/predownload.test.ts	Adds branch-coverage tests for agent image selection presets and invalid custom image reference handling.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 1

+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockResolveCopilotApiKey.mockReturnValue(undefined);
+    // Clear env vars that affect the output
+    delete process.env.OPENAI_API_KEY;
+    delete process.env.ANTHROPIC_API_KEY;
+    delete process.env.COPILOT_GITHUB_TOKEN;
+    delete process.env.GEMINI_API_KEY;
+    delete process.env.GITHUB_TOKEN;
+    delete process.env.GH_TOKEN;
+    delete process.env.AWF_AUDIT_DIR;
+    delete process.env.AWF_SESSION_STATE_DIR;
+  });


lpcox · 2026-05-20T14:39:29Z

@copilot address review feedback

Copilot · 2026-05-20T14:42:58Z

@copilot address review feedback

Fixed in commit test: restore process.env in build-config tests after each test.

The beforeEach now snapshots all relevant env vars (including *_API_TARGET and *_API_BASE_PATH variants) before clearing them, and a new afterEach restores the originals. The ad-hoc delete calls inside individual test cases were also removed since cleanup is now handled uniformly.

github-actions · 2026-05-20T14:58:57Z

🔥 Smoke Test Results

Test	Status
GitHub MCP (list PRs)	✅
GitHub.com connectivity	✅
File write/read	✅ (`smoke-test-copilot-26170037519.txt` verified)

Overall: PASS

PR: [Test Coverage] Add test coverage for build-config and predownload commands
Author: @github-actions[bot] · Reviewer: @lpcox

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-05-20T14:59:15Z

Smoke Test: Copilot BYOK Offline Mode

Test	Result
GitHub MCP connectivity (list PRs)	✅
GitHub.com HTTP connectivity	⚠️ pre-step vars not expanded
File write/read	⚠️ pre-step vars not expanded
BYOK inference (this response)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.

PR by github-actions[bot] · Assignees: @lpcox, @Copilot

Overall: PASS (core BYOK inference path confirmed ✅)

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-05-20T14:59:16Z

✅ GitHub API - 2 PR entries confirmed
✅ Playwright - GitHub page title verified
✅ File verify - smoke test file exists

Result: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-05-20T14:59:50Z

Merged PRs: Align log discovery with canonical Squid container constant; Refactor api-proxy startup to adapter-only validation/model discovery paths
GitHub PR review: ✅
Safe Inputs GH CLI: ❌ safeinputs-gh unavailable
Playwright title check: ✅
Tavily search: ❌ no exposed Tavily tools
File/Bash: ✅
Discussion comment: ✅
Build AWF: ✅
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-05-20T15:00:07Z

Smoke Test Results

GitHub MCP Testing: ❌ (mcpscripts not found)
GitHub.com Connectivity: ❌ (Status 000/400)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

github-actions · 2026-05-20T15:01:21Z

Chroot Smoke Test Results

Runtime	Host Version	Chroot Version	Match?
Python	3.12.13	3.12.3	❌
Node.js	v24.15.0	v20.20.2	❌
Go	go1.22.12	go1.22.12	✅

Overall: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot.

Tested by Smoke Chroot

github-actions · 2026-05-20T15:01:40Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #3455 · ● 6.2M · ◷

github-actions · 2026-05-20T15:02:20Z

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ Timeout (no response on `host.docker.internal:6379`)
PostgreSQL pg_isready	❌ No response on `host.docker.internal:5432`
PostgreSQL SELECT 1	❌ Could not connect

Overall: FAIL

host.docker.internal resolves to 172.17.0.1 but service containers are unreachable — ports 6379 and 5432 timed out. Services may not be running or firewall rules are blocking access.

🔌 Service connectivity validated by Smoke Services

This comment has been minimized.

Sign in to view

lpcox marked this pull request as ready for review May 20, 2026 13:53

Copilot AI review requested due to automatic review settings May 20, 2026 13:53

Copilot started reviewing on behalf of lpcox May 20, 2026 13:54 View session

github-actions Bot mentioned this pull request May 20, 2026

[aw] Smoke OpenCode failed #3462

Closed

github-actions Bot added the smoke-claude label May 20, 2026

This comment has been minimized.

Sign in to view

github-actions Bot added the build-test label May 20, 2026

Copilot AI reviewed May 20, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

github-actions Bot added the smoke-copilot label May 20, 2026

Copilot started work on behalf of lpcox May 20, 2026 14:39 View session

test: restore process.env in build-config tests after each test

d9c30e6

Copilot finished work on behalf of lpcox May 20, 2026 14:43

Copilot AI requested a review from lpcox May 20, 2026 14:43

github-actions Bot mentioned this pull request May 20, 2026

[aw] Security Guard failed #3464

Closed

github-actions Bot added the smoke-copilot-byok label May 20, 2026

github-actions Bot mentioned this pull request May 20, 2026

[aw] Smoke Gemini failed #3465

Closed

lpcox merged commit 3b84f2e into main May 20, 2026
64 of 68 checks passed

lpcox deleted the test-coverage/build-config-and-predownload-753dcda958fe5705 branch May 20, 2026 15:22

This was referenced May 20, 2026

Optimize Security Guard workflow cost profile (Sonnet 4.5, 3-turn cap, early noop gate) #3461

Merged

feat: add OpenTelemetry distributed tracing to api-proxy sidecar #3470

Merged

Conversation

github-actions Bot commented May 20, 2026

Summary

1. src/commands/build-config.ts — 0% → ~95% coverage

2. src/commands/predownload.ts — +4 branch coverage tests

Coverage Impact

Security Coverage Added

No Bugs Found

Uh oh!

This comment has been minimized.

github-actions Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented May 20, 2026

Uh oh!

Copilot AI commented May 20, 2026

Uh oh!

github-actions Bot commented May 20, 2026

🔥 Smoke Test Results

Uh oh!

github-actions Bot commented May 20, 2026

Smoke Test: Copilot BYOK Offline Mode

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

github-actions Bot commented May 20, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented May 20, 2026

Chroot Smoke Test Results

Uh oh!

github-actions Bot commented May 20, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented May 20, 2026

Smoke Test: GitHub Actions Services Connectivity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

1. `src/commands/build-config.ts` — 0% → ~95% coverage

2. `src/commands/predownload.ts` — +4 branch coverage tests

github-actions Bot commented May 20, 2026 •

edited

Loading