Fix ARC/DinD agent safe-output staging paths - #8933
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The default-path regression assertion depends on shared filesystem state and can pass without testing the new behavior.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Adds ARC/DinD-safe agent staging under both default and RUNNER_TEMP roots.
Changes:
- Pre-stages the
agentdirectory in both filesystem locations. - Adds regression coverage for default and ARC/DinD paths.
| File | Description |
|---|---|
src/dind-bootstrap.ts |
Creates and daemon-stages agent directories. |
src/dind-bootstrap.test.ts |
Tests staging behavior with and without RUNNER_TEMP. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| process.env.RUNNER_TEMP = runnerTemp; | ||
| const runnerStageDir = path.join(runnerTemp, 'gh-aw', 'agent'); | ||
| const tmpStageDir = '/tmp/gh-aw/agent'; | ||
| const tmpStageDirExisted = fs.existsSync(tmpStageDir); |
|
@copilot address review feedback |
Addressed in |
|
✅ Copilot review passed with no inline comments. @copilot Add the |
|
✅ Smoke Gemini completed. All facets verified. 💎 Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"
- "play.googleapis.com"See Network Configuration for more information.
|
|
Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed. Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"
- "github.com"See Network Configuration for more information.
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "o205451.ingest.us.sentry.io"See Network Configuration for more information.
|
|
✅ Build Test Suite completed successfully! Warning Firewall blocked 7 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.nuget.org"
- "bun.sh"
- "dc.services.visualstudio.com"
- "deno.land"
- "dl.deno.land"
- "github.com"
- "releaseassets.githubusercontent.com"See Network Configuration for more information.
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 13 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "accounts.google.com"
- "android.clients.google.com"
- "api.github.com"
- "clients2.google.com"
- "collector.github.com"
- "contentautofill.googleapis.com"
- "github.com"
- "github.githubassets.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
🚀 Security Guard has started processing this pull request |
Smoke Test: Cloud Hypervisor + Copilot
All checks passed ✅ Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"
- "github.com"See Network Configuration for more information.
|
Smoke Test: Copilot BYOK (Direct) Mode✅ GitHub MCP connectivity — PR data fetched Status: PASS — Running in direct BYOK mode (
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
github-actions
Bot
added
the
smoke-copilot-network-isolation
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (api.github.com) reachable — Overall: PASS cc Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "api.github.com"
- "example.com"See Network Configuration for more information.
|
|
Copilot Engine Smoke Test
Recent merged PRs checked:
Overall: PASS cc
|
|
Smoke Test: Services Connectivity
Overall: PASS
|
Gemini Engine Smoke Test Results
Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"
- "play.googleapis.com"See Network Configuration for more information.
|
Chroot Version Comparison Results
Overall: FAILED — Node.js version mismatch between host and chroot environments (host
|
📡 OTel Tracing Smoke Test Results
All scenarios pass — no regressions detected in the OTEL tracing integration. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "o205451.ingest.us.sentry.io"See Network Configuration for more information.
|
|
Enforce AWF domain policy on Claude hosted web search and fetch Warning Firewall blocked 13 domainsThe following domains were blocked by the firewall during workflow execution:
[!TIP] tools:
github:
mode: gh-proxySee GitHub Tools for more information on To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"
- "accounts.google.com"
- "android.clients.google.com"
- "api.github.com"
- "clients2.google.com"
- "collector.github.com"
- "contentautofill.googleapis.com"
- "github.com"
- "github.githubassets.com"
- "msfeed25.pkgs.visualstudio.com"
- "update.googleapis.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 7/8 ecosystems passed — FAIL ❌ Java failure detailsBoth Root cause: All other 7 ecosystems (Bun, C++, Deno, .NET, Go, Node.js, Rust) built and passed their tests cleanly with the firewall in place. Warning Firewall blocked 7 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.nuget.org"
- "bun.sh"
- "dc.services.visualstudio.com"
- "deno.land"
- "dl.deno.land"
- "github.com"
- "releaseassets.githubusercontent.com"See Network Configuration for more information.
|
ARC/DinD separates runner and Docker-daemon filesystems, leaving safe-output payload staging unavailable when only
/tmp/gh-aw/agentexists. WhenRUNNER_TEMPis available, both staging roots must exist.Agent staging
/tmp/gh-aw/agentfor existing flows.${RUNNER_TEMP}/gh-aw/agentfor daemon-visible ARC/DinD staging.DinD bootstrap
agentin the pre-staged directory set.${RUNNER_TEMP}/gh-awthrough Docker when it differs from the configured work directory./tmp/gh-aw.RUNNER_TEMPcreates and pre-stages both locations.