[Test Coverage] Branch coverage gaps: signal-handler, preflight, compose-generator, compose-network by github-actions[bot] · Pull Request #6085 · github/gh-aw-firewall

github-actions · 2026-07-10T09:24:44Z

Summary

Closes branch-coverage gaps identified in the coverage report for security-critical code paths.

Files Added

`src/coverage-branch-gaps-3.test.ts`

Covers uncovered branches across multiple files:

commands/signal-handler.ts line 46: SIGTERM with keepContainers=true (false branch of getContainersStarted() && !keepContainers)
commands/preflight.ts lines 51, 73, 82, 217: String(error) path when non-Error objects are thrown in config loading, domain file reading, ruleset loading, and blocked-domain validation
compose-generator.ts line 84: process.env.GITHUB_WORKSPACE unset → process.cwd() fallback branch
compose-generator.ts line 152: redactDockerComposeSecrets with a service that has no environment key (falsy branch of &&)
compose-network.ts line 37: squidService.networks already populated (truthy branch of || {})

`src/compose-generator-buildlocal.test.ts`

Covers the throw path in generateDockerCompose when buildLocal=true but the containers/ directory is absent (line 29). Uses a module-level jest.mock('fs') to make existsSync configurable — kept in a separate file to avoid conflicts with tests that need real fs.

Branches Covered

File	Line	Branch	Description
`commands/signal-handler.ts`	46	BRDA:46,2,1	SIGTERM with `keepContainers=true`
`commands/preflight.ts`	51	BRDA:51,1,1	`String(error)` in config load catch
`commands/preflight.ts`	73	BRDA:73,4,1	non-Error in domains-file catch
`commands/preflight.ts`	82	BRDA:82,7,1	non-Error in ruleset-file catch
`commands/preflight.ts`	217	BRDA:217,17,1	non-Error in blocked-domain validation
`compose-generator.ts`	29	BRDA:29,1,0	`buildLocal` + missing containers dir
`compose-generator.ts`	84	BRDA:84,5,1	`GITHUB_WORKSPACE` unset fallback
`compose-generator.ts`	152	BRDA:152,6,1	service without `environment` key
`compose-network.ts`	37	BRDA:37,1,1	`squidService.networks` pre-existing

Test Results

All 12 new tests pass locally.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Test Coverage Improver · 271.7 AIC · ⊞ 5.3K · ◷

Cover previously-uncovered branches identified in the coverage report: - commands/signal-handler.ts line 46: SIGTERM with keepContainers=true - commands/preflight.ts lines 51,73,82,217: String(error) for non-Error - compose-generator.ts line 29: buildLocal + missing containers dir - compose-generator.ts line 84: GITHUB_WORKSPACE unset fallback - compose-generator.ts line 152: service without environment key - compose-network.ts line 37: squidService.networks pre-existing Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-07-10T11:20:16Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	99.17%	99.22%	📈 +0.05%
Statements	99.13%	99.18%	📈 +0.05%
Functions	99.45%	99.45%	➡️ +0.00%
Branches	95.75%	96.00%	📈 +0.25%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/compose-generator.ts`	97.6% → 100.0% (+2.39%)	97.6% → 100.0% (+2.39%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Adds targeted Jest tests to close branch-coverage gaps in several security-critical paths (signal handling shutdown, preflight error handling, and Docker compose generation/network wiring).

Changes:

Add a focused multi-target branch-coverage test suite covering signal-handler, preflight non-Error catch branches, compose-generator fallbacks, secret redaction, and compose-network merge behavior.
Add a dedicated test file to cover generateDockerCompose’s --build-local “missing containers dir” throw path with a module-level fs mock.

Show a summary per file

File	Description
src/coverage-branch-gaps-3.test.ts	Adds targeted branch-coverage tests for signal handling, preflight error logging branches, compose generation fallbacks/redaction, and compose network merging.
src/compose-generator-buildlocal.test.ts	Adds tests for the `buildLocal=true` guard path when the `containers/` directory is missing, using a dedicated `fs` mock setup.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 6
Review effort level: Low

+ * Targets:
+ *  src/commands/signal-handler.ts  line 46: SIGTERM + keepContainers=true (false branch of &&)
+ *  src/commands/preflight.ts       lines 51,73,82,217: String(error) path for non-Error throws
+ *  src/compose-generator.ts        line 29: buildLocal + containers dir missing (throw branch)


+  it('uses non-Error value directly when loadAndMergeDomains throws a non-Error (line 82)', () => {
+    mockedRules.loadAndMergeDomains.mockImplementation(() => {
+      // eslint-disable-next-line @typescript-eslint/only-throw-error
+      throw { message: 'yaml object error' };
+    });
+
+    expect(() => parseDomainOptions({ rulesetFile: ['/bad.yml'] })).toThrow('process.exit called');
+    expect(mockedLogger.error).toHaveBeenCalledWith(
+      expect.stringContaining('Failed to load ruleset file')
+    );
+  });


+    // squid must have both awf-net (original) and awf-ext (added)
+    const squidNetworks = squidService.networks as Record<string, unknown>;
+    expect(squidNetworks).toHaveProperty('awf-net');
+    expect(squidNetworks).toHaveProperty('awf-ext');


lpcox · 2026-07-10T11:36:24Z

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

… tests

Copilot · 2026-07-10T11:40:16Z

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, app...

All 6 review comments addressed in commit c667fe8:

File header — updated to clarify that only line 51 uses String(error) while lines 73/82/217 use the raw non-Error value in a template literal.
Domains-file test (line 164-167) — assertion now checks 'Failed to read domains file: 42' to include the thrown value.
Ruleset-file test (lines 170-180) — changed thrown value from { message: 'yaml object error' } to the string 'yaml-parse-error', and assertion now checks 'Failed to load ruleset file: yaml-parse-error'.
Blocked-domain validation test (lines 205-208) — assertion now checks 'Invalid blocked domain or pattern: string validation error' to include the thrown string.
Compose-network test (lines 317-320) — asserts via result.services['squid-proxy'].networks instead of the local squidService alias.
Buildlocal endsWith check — changed to path.basename(p) === 'containers' to avoid false positives like /tmp/mycontainers.

github-actions · 2026-07-10T12:10:12Z

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-10T12:10:31Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-10T12:10:32Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-10T12:10:33Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-10T12:10:34Z

✅ Smoke Claude passed

github-actions · 2026-07-10T12:10:34Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-10T12:10:35Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

github-actions · 2026-07-10T12:10:37Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-10T12:10:37Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-10T12:10:37Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

github-actions · 2026-07-10T12:10:38Z

✅ Contribution Check completed successfully!

PR #6085 follows the applicable CONTRIBUTING.md guidelines: changes are organized under src/, targeted tests are included for the coverage gaps, the PR description clearly explains the scope and reports test results, and no documentation update is needed for test-only changes.

github-actions · 2026-07-10T12:10:40Z

✅ Smoke Gemini completed. All facets verified. 💎

Smoke test failed. GitHub MCP tools missing and connectivity to GitHub.com failed.

github-actions · 2026-07-10T12:10:48Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-07-10T12:10:51Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-10T12:13:53Z

Smoke Test: PAT Auth — PASS ✅

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	⚠️ Template vars unsubstituted (pre-step issue)

Overall: PASS

CC @lpcox — Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T12:14:06Z

Smoke Test: Services Connectivity

Redis PING: ❌ Network unreachable
PostgreSQL pg_isready: ❌ No response
PostgreSQL SELECT 1: ❌ Network unreachable

Result: FAIL — host.docker.internal (172.17.0.1) is not reachable. Service containers may not be running or network route is unavailable.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T12:14:06Z

🔬 Smoke Test Results

Test	Status
GitHub MCP Connectivity	✅
GitHub.com HTTP	✅ 200
File Write/Read	❌ (pre-step template vars unresolved)

Overall: PASS (core connectivity confirmed)
Author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T12:14:18Z

Smoke Test: Copilot BYOK (Direct)

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP 200	✅
File write/read	✅
BYOK inference (api-proxy → api.githubcopilot.com)	✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall: PASS @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T12:14:25Z

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
S1: Module Loading	✅ Pass	`otel.js` loads successfully; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled` + internal symbols
S2: Test Suite	✅ Pass	39 tests passed, 0 failed across `otel.test.js`
S3: Env Var Forwarding	✅ Pass	`src/services/api-proxy-env-config.ts` forwards all 6 OTEL vars (`GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME`)
S4: Token Tracker Integration	✅ Pass	`onUsage` callback exists in `token-tracker-http.js` (line 343) as the OTEL hook point
S5: OTEL Diagnostics	✅ Pass	Local fallback active — spans written to `/var/log/api-proxy/otel.jsonl` when no OTLP endpoint configured

All scenarios pass.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T12:14:46Z

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: PASS ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6085 · 55.2 AIC · ⊞ 5.8K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T12:15:12Z

Smoke Test Results

GitHub MCP: ✅ (PRs: Fix logic for token unsetting, Add diagnostic collector)
GitHub connectivity: ✅ (200)
File writing: ✅
Bash tool: ✅

Overall status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T12:15:40Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6085 · 37.7 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T12:16:50Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Not all tests passed — smoke-chroot label not added.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

lpcox marked this pull request as ready for review July 10, 2026 11:17

Copilot AI review requested due to automatic review settings July 10, 2026 11:17

Copilot started reviewing on behalf of lpcox July 10, 2026 11:18 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 10, 2026 11:37 View session

fix: address review feedback on coverage-branch-gaps-3 and buildlocal…

c667fe8

… tests

Copilot finished work on behalf of lpcox July 10, 2026 11:40

Copilot AI requested a review from lpcox July 10, 2026 11:40

lpcox added the ready-for-aw label Jul 10, 2026

lpcox had a problem deploying to aoai-model July 10, 2026 12:10 — with GitHub Actions Failure

github-actions Bot mentioned this pull request Jul 10, 2026

[aw] Smoke Codex has stale lock file #6089

Closed

lpcox temporarily deployed to aoai-model July 10, 2026 12:13 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-pat label Jul 10, 2026

github-actions Bot mentioned this pull request Jul 10, 2026

[aw] No-Op Runs #5883

Open

github-actions Bot added the smoke-copilot-byok label Jul 10, 2026

lpcox temporarily deployed to aoai-model July 10, 2026 12:14 — with GitHub Actions Inactive

This was referenced Jul 10, 2026

[aw] Smoke Copilot BYOK AOAI (api-key) failed #6090

Closed

[aw] Smoke Copilot BYOK AOAI (Entra) failed #6091

Closed

github-actions Bot added smoke-claude smoke-gemini labels Jul 10, 2026

github-actions Bot added the build-test label Jul 10, 2026

lpcox merged commit 441235d into main Jul 10, 2026
84 of 88 checks passed

lpcox deleted the test/coverage-branch-gaps-3-9f24c6b911328558 branch July 10, 2026 12:42

Uh oh!

Conversation

github-actions Bot commented Jul 10, 2026

Summary

Files Added

src/coverage-branch-gaps-3.test.ts

src/compose-generator-buildlocal.test.ts

Branches Covered

Test Results

Uh oh!

github-actions Bot commented Jul 10, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lpcox commented Jul 10, 2026

Uh oh!

Copilot AI commented Jul 10, 2026

Uh oh!

github-actions Bot commented Jul 10, 2026

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026

Smoke Test: PAT Auth — PASS ✅

Uh oh!

github-actions Bot commented Jul 10, 2026

Smoke Test: Services Connectivity

Uh oh!

github-actions Bot commented Jul 10, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Jul 10, 2026

Smoke Test: Copilot BYOK (Direct)

Uh oh!

github-actions Bot commented Jul 10, 2026

Smoke Test: API Proxy OpenTelemetry Tracing

`src/coverage-branch-gaps-3.test.ts`

`src/compose-generator-buildlocal.test.ts`

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading