Refactor Cloud Hypervisor preflight into focused modules - #8889
Conversation
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The extraction preserves existing behavior and import compatibility with focused coverage for each module.
Review effort: Balanced
Findings: None
What changed in this PR
Refactors Cloud Hypervisor preflight responsibilities into focused modules while preserving the existing facade API.
Changes:
- Extracts artifact trust, snapshotting, and diagnostics logic.
- Splits corresponding tests into focused suites.
- Re-exports moved APIs to maintain caller compatibility.
| File | Description |
|---|---|
src/cloud-hypervisor/preflight.ts |
Retains orchestration and re-exports extracted APIs. |
src/cloud-hypervisor/preflight.test.ts |
Removes relocated snapshot tests. |
src/cloud-hypervisor/preflight-diagnostics.ts |
Hosts execution diagnostics and mount parsing. |
src/cloud-hypervisor/preflight-diagnostics.test.ts |
Tests extracted diagnostic helpers. |
src/cloud-hypervisor/artifact-trust.ts |
Hosts ownership, permissions, and digest checks. |
src/cloud-hypervisor/artifact-trust.test.ts |
Tests artifact and host-tool trust validation. |
src/cloud-hypervisor/artifact-snapshot.ts |
Hosts secure artifact staging and sparse copying. |
src/cloud-hypervisor/artifact-snapshot.test.ts |
Tests snapshot creation and mount validation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
✅ Copilot review passed with no inline comments. @copilot Add the |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 92.04% | 92.07% | 📈 +0.03% |
| Statements | 90.52% | 90.56% | 📈 +0.04% |
| Functions | 89.98% | 89.51% | 📉 -0.47% |
| Branches | 83.87% | 83.88% | ➡️ +0.01% |
📁 Per-file Coverage Changes (3 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/nvx/one-shot-adapter.ts |
81.3% → 80.7% (-0.59%) | 78.5% → 78.0% (-0.56%) |
src/cloud-hypervisor/preflight.ts |
94.6% → 95.9% (+1.28%) | 93.4% → 96.0% (+2.60%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (3 files)
src/cloud-hypervisor/artifact-snapshot.ts: 95.2% linessrc/cloud-hypervisor/artifact-trust.ts: 97.1% linessrc/cloud-hypervisor/preflight-diagnostics.ts: 94.4% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 12 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "accounts.google.com"
- "api.github.com"
- "clients2.google.com"
- "collector.github.com"
- "contentautofill.googleapis.com"
- "github.com"
- "github.githubassets.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "example.com"See Network Configuration for more information.
|
|
✅ Build Test Suite completed successfully! Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.nuget.org"
- "bun.sh"
- "dc.services.visualstudio.com"
- "deno.land"
- "dl.deno.land"
- "github.com"
- "releaseassets.githubusercontent.com"
- "repo.maven.apache.org"See Network Configuration for more information.
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "o205451.ingest.us.sentry.io"See Network Configuration for more information.
|
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...
|
|
🚀 Security Guard has started processing this pull request |
|
Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"
- "github.com"See Network Configuration for more information.
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (api.github.com): reachable, HTTP 200 Overall: PASS
Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "example.com"See Network Configuration for more information.
|
🔥 Smoke Test: Copilot Engine
Overall: PASS cc
|
Smoke Test: Cloud Hypervisor + Copilot
Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"
- "github.com"See Network Configuration for more information.
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
Smoke Test: Services Connectivity
Overall: PASS
|
Smoke Test: Copilot BYOK (Direct) Mode✅ All tests passed
Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY via api-proxy sidecar) Status: PASS
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Notes:
Warning Firewall blocked 8 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.nuget.org"
- "bun.sh"
- "dc.services.visualstudio.com"
- "deno.land"
- "dl.deno.land"
- "github.com"
- "releaseassets.githubusercontent.com"
- "repo.maven.apache.org"See Network Configuration for more information.
|
📡 OTel Tracing Smoke Test Results
Overall: All 5 scenarios pass or behave as expected. No tracing regression detected. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "o205451.ingest.us.sentry.io"See Network Configuration for more information.
|
Chroot Version Comparison Results
|
|
#8879 Upgrade gh-aw workflows to latest pre-release Warning Firewall blocked 12 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "accounts.google.com"
- "api.github.com"
- "clients2.google.com"
- "collector.github.com"
- "contentautofill.googleapis.com"
- "github.com"
- "github.githubassets.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
src/cloud-hypervisor/preflight.tsmixed preflight orchestration with artifact trust checks, snapshot staging, and execution diagnostics on a security-sensitive path. This PR separates those concerns while preserving the existing./preflightimport surface for callers.Artifact trust
artifact-trust.ts.Artifact snapshotting
artifact-snapshot.ts.Diagnostics
preflight-diagnostics.ts.Tests