[test-improver] Improve tests for config package container runtime and gateway validation

[github-actions]

Summary

Added internal/config/container_runtime_test.go to cover previously untested branches in the config package's container runtime and gateway validation helpers.

File analyzed

internal/config/container_runtime.go and internal/config/validation_gateway.go

Improvements made

Added tests for four previously uncovered branches:

1. effectiveContainerRuntimeName — Added test for the case where MCP_GATEWAY_CONTAINER_RUNTIME is set to an invalid value (neither docker nor podman). The function should log a warning and fall back to the config value.

2. configuredContainerRuntimeCommand — Added test for the case where gateway.ContainerRuntimeCommand is non-empty (a custom runtime command path/name). This branch had cov0 (completely uncovered).

3. validateContainerRuntimeCommandNotBlank — Added tests for the whitespace-only command rejection path (tab, space, newline), which was at 66.7% coverage.

4. validateGatewayPayloadSizeThreshold — Added tests for both the valid (positive integer) and invalid (zero, negative) paths. This standalone helper was at 66.7% coverage.

Coverage before/after

Function	Before	After
effectiveContainerRuntimeName	87.5%	100.0%
configuredContainerRuntimeCommand	83.3%	100.0%
validateContainerRuntimeCommandNotBlank	66.7%	100.0%
validateGatewayPayloadSizeThreshold	66.7%	100.0%
Package total	97.7%	97.9%

Test output

--- PASS: TestEffectiveContainerRuntimeName_InvalidEnvVar
--- PASS: TestConfiguredContainerRuntimeCommand
--- PASS: TestValidateContainerRuntimeCommandNotBlank
--- PASS: TestValidateGatewayPayloadSizeThreshold
ok  github.com/github/gh-aw-mcpg/internal/config  1.625s

All existing tests continue to pass.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "index.crates.io"

See Network Configuration for more information.

Generated by Test Improver · sonnet46 · 215.4 AIC · ⊞ 5.8K · ◷

[Copilot]

Pull request overview

Adds focused config tests for container-runtime selection, custom runtime commands, whitespace validation, and payload thresholds.

Changes:

• Covers container runtime environment/config fallback behavior.
• Tests runtime command and gateway validation branches.

Show a summary per file

File	Description
internal/config/container_runtime_test.go	Adds config helper unit tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Medium

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602] — gateway tool-filter	BLOCKED	✅
C	CLI	reads	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated (no GH_TOKEN)	BLOCKED	✅

Notes:

• Part B: Gateway exposes exactly 22 read-only tools; write tools absent from schema — unknown tool [-32602] is gateway enforcement by tool-filtering.
• Parts D/E: gh CLI carries no token in this runtime — all REST/GraphQL write attempts rejected at authentication.

Overall: PASS

References: §30316811141

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated — exit 4	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated — exit 4	BLOCKED	✅

Overall: PASS

Notes:

• Part B: Gateway enforces read-only by exposing only read tools; all 7 write tool calls returned Error [-32602]: unknown tool from the gateway.
• Parts D & E: gh CLI unauthenticated in this sandbox; all REST/GraphQL writes rejected at auth layer (exit 4).

References: §30316811119

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/PRs/commits, get_file)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tool absent (GITHUB_READ_ONLY=true)	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	blocked — gh unauthenticated	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked — gh unauthenticated	BLOCKED	✅

Overall: PASS

i️ Gateway enforces read-only via GITHUB_READ_ONLY=true env var injected into the backend container, removing write tools from the MCP tool list entirely. All 7 Part B write attempts returned Error [-32602]: unknown tool. The gh CLI is unauthenticated in this runtime, blocking all Part D/E writes at the API auth layer.

References: §30316811107

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime