Skip to content

Refactor Cloud Hypervisor preflight into focused modules - #8889

Merged
lpcox merged 4 commits into
mainfrom
copilot/refactor-split-preflight-module
Sep 22, 2026
Merged

lpcox merged 4 commits into
mainfrom
copilot/refactor-split-preflight-module

Conversation

Copilot AI commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

src/cloud-hypervisor/preflight.ts mixed preflight orchestration with artifact trust checks, snapshot staging, and execution diagnostics on a security-sensitive path. This PR separates those concerns while preserving the existing ./preflight import surface for callers.

  • Artifact trust

    • Moved ownership, permission, ancestor-chain, and digest validation into artifact-trust.ts.
    • Shared the trust dependency shape with preflight orchestration to avoid interface drift.
  • Artifact snapshotting

    • Moved snapshot creation and sparse rootfs copying into artifact-snapshot.ts.
    • Kept exec-capable artifact-root checks with the staging flow.
  • Diagnostics

    • Moved mount, ACL, path component, and execution-failure diagnostics into preflight-diagnostics.ts.
    • Documented the best-effort string contracts for the newly public helpers.
  • Tests

    • Split snapshot and diagnostics coverage into focused test files.
    • Added direct host-tool trust coverage for non-absolute paths, unsafe ancestors, and non-root-owned tools.
// Existing callers can continue importing from the facade.
import {
  runCloudHypervisorPreflight,
  copySparseFileWithRsync,
  type CloudHypervisorPreflightResult,
} from './preflight';

Copilot AI changed the title [WIP] Refactor preflight.ts into focused modules Refactor Cloud Hypervisor preflight into focused modules Sep 22, 2026
Copilot AI requested a review from lpcox September 22, 2026 16:19
@lpcox
lpcox marked this pull request as ready for review September 22, 2026 16:19
Copilot AI balanced review requested due to automatic review settings September 22, 2026 16:19

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The extraction preserves existing behavior and import compatibility with focused coverage for each module.

Review effort: Balanced
Findings: None

What changed in this PR

Refactors Cloud Hypervisor preflight responsibilities into focused modules while preserving the existing facade API.

Changes:

  • Extracts artifact trust, snapshotting, and diagnostics logic.
  • Splits corresponding tests into focused suites.
  • Re-exports moved APIs to maintain caller compatibility.
File Description
src/​cloud-hypervisor/​preflight.ts Retains orchestration and re-exports extracted APIs.
src/​cloud-hypervisor/​preflight.test.ts Removes relocated snapshot tests.
src/​cloud-hypervisor/​preflight-diagnostics.ts Hosts execution diagnostics and mount parsing.
src/​cloud-hypervisor/​preflight-diagnostics.test.ts Tests extracted diagnostic helpers.
src/​cloud-hypervisor/​artifact-trust.ts Hosts ownership, permissions, and digest checks.
src/​cloud-hypervisor/​artifact-trust.test.ts Tests artifact and host-tool trust validation.
src/​cloud-hypervisor/​artifact-snapshot.ts Hosts secure artifact staging and sparse copying.
src/​cloud-hypervisor/​artifact-snapshot.test.ts Tests snapshot creation and mount validation.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@github-actions

Copy link
Copy Markdown
Contributor

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

@github-actions

Copy link
Copy Markdown
Contributor

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric Base PR Delta
Lines 92.04% 92.07% 📈 +0.03%
Statements 90.52% 90.56% 📈 +0.04%
Functions 89.98% 89.51% 📉 -0.47%
Branches 83.87% 83.88% ➡️ +0.01%
📁 Per-file Coverage Changes (3 files)
File Lines (Before → After) Statements (Before → After)
src/nvx/one-shot-adapter.ts 81.3% → 80.7% (-0.59%) 78.5% → 78.0% (-0.56%)
src/cloud-hypervisor/preflight.ts 94.6% → 95.9% (+1.28%) 93.4% → 96.0% (+2.60%)
src/log-directory-setup.ts 96.2% → 100.0% (+3.78%) 96.3% → 100.0% (+3.71%)
✨ New Files (3 files)
  • src/cloud-hypervisor/artifact-snapshot.ts: 95.2% lines
  • src/cloud-hypervisor/artifact-trust.ts: 97.1% lines
  • src/cloud-hypervisor/preflight-diagnostics.ts: 94.4% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 12 domains

The following domains were blocked by the firewall during workflow execution:

  • ab.chatgpt.com
  • accounts.google.com
  • api.github.com
  • clients2.google.com
  • collector.github.com
  • contentautofill.googleapis.com
  • github.com
  • github.githubassets.com
  • msfeed25.pkgs.visualstudio.com
  • update.googleapis.com
  • www.google.com
  • www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • api.github.com
  • example.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

Build Test Suite completed successfully!

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

  • api.nuget.org
  • bun.sh
  • dc.services.visualstudio.com
  • deno.land
  • dl.deno.land
  • github.com
  • releaseassets.githubusercontent.com
  • repo.maven.apache.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.nuget.org"
    - "bun.sh"
    - "dc.services.visualstudio.com"
    - "deno.land"
    - "dl.deno.land"
    - "github.com"
    - "releaseassets.githubusercontent.com"
    - "repo.maven.apache.org"

See Network Configuration for more information.

Generated by Build Test Suite for #8889

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8889

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • o205451.ingest.us.sentry.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing

@lpcox
lpcox enabled auto-merge (squash) September 22, 2026 17:24
@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

@github-actions

Copy link
Copy Markdown
Contributor

🚀 Security Guard has started processing this pull request

@github-actions

github-actions Bot commented Sep 22, 2026

Copy link
Copy Markdown
Contributor

Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • example.com
  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "github.com"

See Network Configuration for more information.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

@github-actions

Copy link
Copy Markdown
Contributor

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com): reachable, HTTP 200
✅ Blocked domain (example.com): connection failed (denied)

Overall: PASS

@lpcox network isolation egress enforcement verified.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • api.github.com
  • example.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
Add label ready-for-aw to run again

@github-actions github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Sep 22, 2026
@github-actions

Copy link
Copy Markdown
Contributor

🔥 Smoke Test: Copilot Engine

Overall: PASS

cc @lpcox

📰 BREAKING: Report filed by Smoke Copilot
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Cloud Hypervisor + Copilot

  1. list_pull_requests (merged, limit 1): PASS — returned PR data (note: state filter returned an open PR, but call succeeded)
  2. curl https://github.com: PASS (200)
  3. Write/read temp file: PASS
  4. curl (example.com/redacted) (blocked): PASS (000)

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • example.com
  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "github.com"

See Network Configuration for more information.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Claude Engine Validation

Check Result
API status ✅ PASS
gh check ✅ PASS
File status ✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8889 · claude · haiku45 · 30 AIC · ⊞ 4.7K ·
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Services Connectivity

  • Redis PING: ✅ (PONG)
  • PostgreSQL pg_isready: ✅ (accepting connections)
  • PostgreSQL SELECT 1: ✅ (1)

Overall: PASS

🔌 Service connectivity validated by Smoke Services
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Copilot BYOK (Direct) Mode

All tests passed

  • ✅ MCP connectivity (github-list_pull_requests verified)
  • ✅ GitHub.com connectivity (HTTP 200)
  • ✅ File write/read (smoke-test-copilot-byok.txt readable)
  • ✅ BYOK inference path active (api-proxy → api.githubcopilot.com)

Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY via api-proxy sidecar)

Status: PASS

🔑 BYOK report filed by Smoke Copilot BYOK
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

🏗️ Build Test Suite Results

Ecosystem Project Build/Install Tests Status
Bun elysia 1/1 passed ✅ PASS
Bun hono 1/1 passed ✅ PASS
C++ fmt N/A ✅ PASS
C++ json N/A ✅ PASS
Deno oak N/A 1/1 passed ✅ PASS
Deno std N/A 1/1 passed ✅ PASS
.NET hello-world N/A ✅ PASS
.NET json-parse N/A ✅ PASS
Go color ok ✅ PASS
Go env ok ✅ PASS
Go uuid ok ✅ PASS
Java gson 1/1 passed ✅ PASS
Java caffeine 1/1 passed ✅ PASS
Node.js clsx passed ✅ PASS
Node.js execa passed ✅ PASS
Node.js p-limit passed ✅ PASS
Rust fd 1/1 passed ✅ PASS
Rust zoxide 1/1 passed ✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

  • All 8 repository clones succeeded.
  • Java (gson, caffeine): the pre-provisioned ~/.m2 directory is owned by root and not writable by the runner user, so the default local repository (~/.m2/repository) could not be created. Worked around this by passing -Dmaven.repo.local=/tmp/gh-aw/agent/m2repo to Maven; the ~/.m2/settings.xml proxy configuration (squid-proxy:3128) was used as-is and worked correctly for dependency resolution through the firewall.

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

  • api.nuget.org
  • bun.sh
  • dc.services.visualstudio.com
  • deno.land
  • dl.deno.land
  • github.com
  • releaseassets.githubusercontent.com
  • repo.maven.apache.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.nuget.org"
    - "bun.sh"
    - "dc.services.visualstudio.com"
    - "deno.land"
    - "dl.deno.land"
    - "github.com"
    - "releaseassets.githubusercontent.com"
    - "repo.maven.apache.org"

See Network Configuration for more information.

Generated by Build Test Suite for #8889 · copilot · auto · 28.9 AIC · ⊞ 11.8K ·
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

📡 OTel Tracing Smoke Test Results

Scenario Result
1. Module Loading otel.js loaded successfully; isEnabled()true; exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, _provider, _ProxyAwareOtlpExporter, _FileSpanExporter, _FanOutSpanExporter, _parseEndpoints, _parseOtlpHeaders, _buildResourceSpans, _createOtlpWorkloadIdentity
2. Test Suite ✅ 3 test suites / 68 tests passed, 0 failed (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js)
3. Env Var Forwarding env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID and GITHUB_AW_OTEL_PARENT_SPAN_ID to the agent; api-proxy-env-config.ts forwards OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, and both trace-context vars to the api-proxy
4. Token Tracker Integration onUsage callback present in token-tracker-http.js (finalizeHttpTracking), invoked with normalized usage + model as the OTEL hook point
5. OTEL Diagnostics ✅ Workflow-level span exported (/tmp/gh-aw/otel.jsonl: 1 span, gh-aw.agent.setup); no api-proxy gen_ai.* spans observed since no live LLM proxy call occurred in this smoke run — expected, not a regression

Overall: All 5 scenarios pass or behave as expected. No tracing regression detected.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • o205451.ingest.us.sentry.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Chroot Version Comparison Results

Runtime Host Version Chroot Version Match?
Python Python 3.12.14 Python 3.12.14 ✅ YES
Node.js v24.21.0 v22.23.2 ❌ NO
Go go1.22.12 go1.22.12 ✅ YES

⚠️ Overall: FAILED — Node.js version mismatch between host and chroot environment. The smoke-chroot label was not applied since not all runtimes matched.

Tested by Smoke Chroot
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

#8879 Upgrade gh-aw workflows to latest pre-release
#8878 fix(security): enforce TLS SNI allowlist
GitHub reads ✅
PR details ✅
Playwright title ✅
File write/read ✅
Discussion comment ✅
AWF build ✅
Overall: PASS

Warning

Firewall blocked 12 domains

The following domains were blocked by the firewall during workflow execution:

  • ab.chatgpt.com
  • accounts.google.com
  • api.github.com
  • clients2.google.com
  • collector.github.com
  • contentautofill.googleapis.com
  • github.com
  • github.githubassets.com
  • msfeed25.pkgs.visualstudio.com
  • update.googleapis.com
  • www.google.com
  • www.gstatic.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "accounts.google.com"
    - "api.github.com"
    - "clients2.google.com"
    - "collector.github.com"
    - "contentautofill.googleapis.com"
    - "github.com"
    - "github.githubassets.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
Add label ready-for-aw to run again

@lpcox
lpcox merged commit 5cd5b0c into main Sep 22, 2026
151 of 158 checks passed
@lpcox
lpcox deleted the copilot/refactor-split-preflight-module branch September 22, 2026 17:35

This branch was successfully deployed

1 active deployment
aoai-model 77acc1af Deployed Sep 22, 2026 by lpcox via conclusion #1736
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Refactoring] Split src/cloud-hypervisor/preflight.ts into focused modules

3 participants