Split docker-manager-compose.test.ts (3,525 lines) by service area by Copilot · Pull Request #2560 · github/gh-aw-firewall

Copilot · 2026-05-05T13:36:25Z

src/docker-manager-compose.test.ts had grown to 3,525 lines with 10+ distinct service areas crammed into a single describe block, making it the largest file in the repo and difficult to navigate or parallelize in CI.

Changes

Deleted the monolithic file and replaced it with six focused test files:

File	Responsibility
`src/compose-generator.test.ts`	Integration: image selection, network config, per-image digests
`src/services/squid-service.test.ts`	Squid container config, stop grace period, base64 config injection
`src/services/agent-service.test.ts`	Agent volumes, env vars, capabilities, all agent option describe blocks (`envFile`, `enableHostAccess`, `allowHostPorts`, `containerWorkDir`, `proxyLogsDir`, `dnsServers`, tmpfs overlay, toolchain vars, `GITHUB_PATH`)
`src/services/api-proxy-service.test.ts`	API proxy sidecar, credential isolation, `AWF_ANTHROPIC_*` forwarding
`src/services/doh-proxy-service.test.ts`	DNS-over-HTTPS proxy sidecar
`src/services/cli-proxy-service.test.ts`	CLI proxy / external DIFC proxy sidecar

All 268 tests are preserved. Each file carries its own execa mock, mockConfig, and mockNetworkConfig — no shared helper module introduced, keeping each file independently readable.

Split the 3525-line test file into 6 focused files: - src/compose-generator.test.ts: general image/network/digest tests (234 lines) - src/services/squid-service.test.ts: squid container config tests - src/services/agent-service.test.ts: agent container tests (all agent, envFile, enableHostAccess, NO_PROXY, allowHostPorts, containerWorkDir, proxyLogsDir, dnsServers, tmpfs, toolchain fallback, GITHUB_PATH) - src/services/api-proxy-service.test.ts: API proxy sidecar tests - src/services/doh-proxy-service.test.ts: DoH proxy sidecar tests - src/services/cli-proxy-service.test.ts: CLI proxy sidecar tests All 268 tests preserved. Zero lint errors introduced. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-05T18:29:58Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	86.45%	86.53%	📈 +0.08%
Statements	86.39%	86.46%	📈 +0.07%
Functions	90.61%	90.61%	➡️ +0.00%
Branches	79.23%	79.27%	📈 +0.04%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/container-lifecycle.ts`	86.1% → 87.2% (+1.09%)	86.3% → 87.4% (+1.08%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

This PR refactors the Docker Compose generation test suite by deleting the former monolithic src/docker-manager-compose.test.ts and replacing it with multiple focused test files organized by service area, aiming to improve readability and make the suite easier to navigate and parallelize.

Changes:

Split Docker Compose generation tests into six service-scoped test files (agent, squid, api-proxy, DoH proxy, CLI proxy, and general compose generation).
Preserved the existing assertions/coverage while re-homing them into smaller, easier-to-maintain suites.
Duplicated local mocks (execa, configs) per file to keep each suite self-contained.

Show a summary per file

File	Description
src/compose-generator.test.ts	Focused tests for compose generation defaults, image selection, digests, and network config.
src/services/squid-service.test.ts	Validates Squid service container configuration and squid.conf base64 injection behavior.
src/services/agent-service.test.ts	Large agent-focused suite covering mounts, env propagation, chroot/hosts pre-resolution, tmpfs overlays, etc.
src/services/api-proxy-service.test.ts	Validates api-proxy sidecar inclusion, env forwarding/isolation, limits, and agent wiring.
src/services/doh-proxy-service.test.ts	Validates DoH sidecar inclusion, healthcheck, limits, and agent DNS/env behavior.
src/services/cli-proxy-service.test.ts	Validates CLI proxy sidecar behavior (DIFC proxy host parsing, env, depends_on, hardening).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (4)

src/services/agent-service.test.ts:180

This test mutates process.env.COPILOT_GITHUB_TOKEN but the cleanup happens after assertions, so a failure will leak the env var into later tests. Wrap the mutation in try/finally and restore the previous value (or delete) in finally.

    it('should forward COPILOT_GITHUB_TOKEN when api-proxy is disabled', () => {
      process.env.COPILOT_GITHUB_TOKEN = 'ghp_test_token';
      const configNoProxy = { ...mockConfig, enableApiProxy: false };
      const result = generateDockerCompose(configNoProxy, mockNetworkConfig);
      const env = result.services.agent.environment as Record<string, string>;

src/services/agent-service.test.ts:189

This test sets process.env.COPILOT_API_KEY and deletes it at the end of the test body. If an assertion throws, cleanup won’t run and later tests may be affected. Use try/finally to restore the prior value.

    it('should forward COPILOT_API_KEY when api-proxy is disabled', () => {
      process.env.COPILOT_API_KEY = 'cpat_test_byok_key';
      const configNoProxy = { ...mockConfig, enableApiProxy: false };
      const result = generateDockerCompose(configNoProxy, mockNetworkConfig);
      const env = result.services.agent.environment as Record<string, string>;

src/services/agent-service.test.ts:209

Same env-leak risk here: process.env.AWF_ONE_SHOT_TOKEN_DEBUG is mutated and only deleted after assertions. Use try/finally (restore previous value) so failures don’t pollute subsequent tests.

    it('should forward AWF_ONE_SHOT_TOKEN_DEBUG when set', () => {
      process.env.AWF_ONE_SHOT_TOKEN_DEBUG = '1';
      const result = generateDockerCompose(mockConfig, mockNetworkConfig);
      const env = result.services.agent.environment as Record<string, string>;
      expect(env.AWF_ONE_SHOT_TOKEN_DEBUG).toBe('1');

src/services/agent-service.test.ts:701

This test claims to verify that domains already present in /etc/hosts aren’t duplicated, but it only checks localhostMatches is defined (which will almost always be true). Add an assertion that mockExecaSync was not called for getent hosts localhost, or assert the hosts file did not gain an extra localhost entry.

      // Count occurrences of 'localhost' - should only be the original entries, not duplicated
      const localhostMatches = content.match(/localhost/g);
      // /etc/hosts typically has multiple localhost entries (127.0.0.1 and ::1)
      // The key assertion is that getent should NOT have been called for localhost
      // since it's already in the hosts file

Files reviewed: 6/7 changed files
Comments generated: 6

+  allowedDomains: ['github.com', 'npmjs.org'],
+  agentCommand: 'echo "test"',
+  logLevel: 'info',
+  keepContainers: false,
+  workDir: '/tmp/awf-test',


+  allowedDomains: ['github.com', 'npmjs.org'],
+  agentCommand: 'echo "test"',
+  logLevel: 'info',
+  keepContainers: false,
+  workDir: '/tmp/awf-test',


+  allowedDomains: ['github.com', 'npmjs.org'],
+  agentCommand: 'echo "test"',
+  logLevel: 'info',
+  keepContainers: false,
+  workDir: '/tmp/awf-test',


+  allowedDomains: ['github.com', 'npmjs.org'],
+  agentCommand: 'echo "test"',
+  logLevel: 'info',
+  keepContainers: false,
+  workDir: '/tmp/awf-test',


+  allowedDomains: ['github.com', 'npmjs.org'],
+  agentCommand: 'echo "test"',
+  logLevel: 'info',
+  keepContainers: false,
+  workDir: '/tmp/awf-test',


+  allowedDomains: ['github.com', 'npmjs.org'],
+  agentCommand: 'echo "test"',
+  logLevel: 'info',
+  keepContainers: false,
+  workDir: '/tmp/awf-test',


lpcox · 2026-05-05T18:37:13Z

@copilot merge main and address the review feedback

…t-docker-manager-compose-test Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/5a602751-aca1-4d39-9b60-5ca0d2457cdd

Copilot · 2026-05-05T18:46:24Z

@copilot merge main and address the review feedback

Done — merged main and fixed all workDir races (commit 6250722). All 6 new test files now use fs.mkdtempSync to generate a unique temp directory per test in beforeEach instead of sharing the fixed /tmp/awf-test path. Hard-coded /tmp/awf-test/... strings in assertions were updated to use mockConfig.workDir template literals, and the two nested describe blocks in agent-service.test.ts that had their own fixed-path configs were fixed the same way. All 1,747 tests pass.

github-actions · 2026-05-05T20:25:19Z

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP (`list_pull_requests`)	✅
GitHub.com connectivity	✅ (pre-step HTTP 200/301)
File write/read (`smoke-test-copilot-byok-25395593607.txt`)	✅ `BYOK smoke test passed at Tue May 5 20:23:43 UTC 2026`
BYOK inference (agent → api-proxy → api.githubcopilot.com)	✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com.

PR: "Split docker-manager-compose.test.ts (3,525 lines) by service area" · Author: @Copilot · Assignees: @lpcox, @Copilot

Overall: PASS ✅

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-05-05T20:26:01Z

🔬 Smoke Test Results

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	⚠️ Template vars unexpanded
File write/read	⚠️ Template vars unexpanded

PR: Split docker-manager-compose.test.ts (3,525 lines) by service area
Author: @Copilot | Assignees: @lpcox, @Copilot

Overall: PARTIAL — MCP ✅, pre-step template variables were not expanded so HTTP/file tests could not be verified.

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-05-05T20:26:33Z

Smoke Test Summary

PRs: refactor: extract shared parameterised test factory for log sub-commands; refactor: split cli.test.ts by feature area into co-located test files
GitHub PR review: ✅; safeinputs-gh: ❌; Playwright: ✅; Tavily: ❌
File write/read: ✅; discussion query/comment: ❌; build: ✅
Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-05-05T20:26:36Z

Smoke Test Results

✅ GitHub API: Last 2 merged PRs retrieved
✅ Playwright: GitHub homepage loaded successfully
✅ File I/O: Test file created and verified
✅ Bash: Commands executed successfully

Overall Status: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-05-05T20:27:53Z

Smoke Test Results

Check	Result
Redis PING	❌ Timeout/no response
PostgreSQL pg_isready	❌ No response
PostgreSQL SELECT 1	❌ Not reachable

Overall: FAIL — host.docker.internal is not reachable from this environment (no Docker network bridging to host service containers).

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-05-05T20:27:55Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #2560 · ● 588.2K · ◷

github-actions · 2026-05-05T20:28:08Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.14.1	v20.20.2	❌
Go	go1.22.12	go1.22.12	✅

Result: Not all tests passed — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

Initial plan

b64c722

Copilot AI assigned Copilot and lpcox May 5, 2026

Copilot started work on behalf of lpcox May 5, 2026 14:06 View session

Copilot AI linked an issue May 5, 2026 that may be closed by this pull request

[Refactoring] Split src/docker-manager-compose.test.ts (3,525 lines) by service area #2542

Closed

Copilot AI changed the title ~~[WIP] Refactor split src/docker-manager-compose.test.ts by service area~~ Split docker-manager-compose.test.ts (3,525 lines) by service area May 5, 2026

Copilot finished work on behalf of lpcox May 5, 2026 14:25

Copilot AI requested a review from lpcox May 5, 2026 14:25

lpcox marked this pull request as ready for review May 5, 2026 18:28

lpcox requested a review from Mossaka as a code owner May 5, 2026 18:28

Copilot AI review requested due to automatic review settings May 5, 2026 18:28

Copilot started reviewing on behalf of lpcox May 5, 2026 18:29 View session

This comment has been minimized.

Sign in to view

github-actions Bot added the smoke-claude label May 5, 2026

This comment has been minimized.

Sign in to view

github-actions Bot mentioned this pull request May 5, 2026

[aw] No-Op Runs #2301

Open

This comment has been minimized.

Sign in to view

Copilot AI reviewed May 5, 2026

View reviewed changes

Copilot started work on behalf of lpcox May 5, 2026 18:37 View session

Merge remote-tracking branch 'origin/main' into copilot/refactor-spli…

324cb4a

…t-docker-manager-compose-test Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

This comment has been minimized.

Sign in to view

github-actions Bot added the build-test label May 5, 2026

fix: use mkdtemp unique workDirs to prevent Jest parallel worker races

6250722

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/5a602751-aca1-4d39-9b60-5ca0d2457cdd

Copilot finished work on behalf of lpcox May 5, 2026 18:47

github-actions Bot added the smoke-copilot-byok label May 5, 2026

github-actions Bot added the smoke-copilot label May 5, 2026

lpcox merged commit 034a067 into main May 5, 2026
63 of 68 checks passed

lpcox deleted the copilot/refactor-split-docker-manager-compose-test branch May 5, 2026 20:41

Conversation

Copilot AI commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

github-actions Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

lpcox commented May 5, 2026

Uh oh!

This comment has been minimized.

Copilot AI commented May 5, 2026

Uh oh!

github-actions Bot commented May 5, 2026

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Uh oh!

github-actions Bot commented May 5, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented May 5, 2026

Smoke Test Summary

Uh oh!

github-actions Bot commented May 5, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented May 5, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented May 5, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented May 5, 2026

Chroot Version Comparison Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 5, 2026 •

edited

Loading

github-actions Bot commented May 5, 2026 •

edited

Loading