Refactor external agent runtime lifecycle by lpcox · Pull Request #7129 · github/gh-aw-firewall

lpcox · 2026-08-09T01:23:06Z

Summary

Stack layer 1/6.

introduce a typed external agent runtime backend lifecycle and resolver/adapter seam
move sbx-specific preflight, environment construction, reflection checks, diagnostics, execution state, and teardown out of main-action
route cleanup and signal fast-stop through the selected backend instance
keep Docker and gVisor on the existing Compose path without abstracting Compose internals
document how future microVM backends register without adding Firecracker behavior

Behavior is intentionally unchanged for Docker, gVisor, and sbx, including API-proxy reflection, credential environment handling, diagnostics, timeout/TTY behavior, keep-containers semantics, and exit-code propagation.

Validation

tsc --noEmit -p tsconfig.check.json
focused Jest suites: 118 tests across runtime resolver/adapter, sbx lifecycle, container runtime, main action, and CLI workflow
npm run build

Stack

Runtime backend abstraction (this PR)
Firecracker runtime implementation
Runtime-specific networking and environment integration
Firecracker lifecycle hardening
Integration and platform coverage
Rollout documentation and final wiring

github-actions · 2026-08-09T01:23:33Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit c305938

github-actions · 2026-08-09T01:25:27Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	94.09%	94.14%	📈 +0.05%
Statements	93.06%	93.12%	📈 +0.06%
Functions	94.47%	94.54%	📈 +0.07%
Branches	86.27%	86.33%	📈 +0.06%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/commands/main-action.ts`	95.8% → 94.7% (-1.12%)	95.3% → 94.8% (-0.57%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (3 files)

src/external-runtime-backend-resolver.ts: 100.0% lines
src/external-runtime-backend.ts: 100.0% lines
src/sbx-runtime-backend.ts: 98.5% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Introduces an external runtime lifecycle abstraction while preserving Compose handling for Docker and gVisor.

Changes:

Adds backend contracts, resolution, and adaptation.
Moves sbx lifecycle logic out of main-action.
Adds lifecycle tests and extension documentation.

Show a summary per file

File	Description
`src/sbx-runtime-backend.ts`	Implements the sbx backend lifecycle.
`src/sbx-runtime-backend.test.ts`	Tests sbx lifecycle behavior.
`src/external-runtime-backend.ts`	Defines and adapts external backends.
`src/external-runtime-backend.test.ts`	Tests resolution and adaptation.
`src/external-runtime-backend-resolver.ts`	Registers and resolves backends.
`src/container-runtime.ts`	Updates microVM extension guidance.
`src/commands/main-action.ts`	Integrates backend execution and cleanup.
`src/commands/main-action.test.ts`	Tests resolver failure handling.
`src/commands/main-action-coverage-gaps.test.ts`	Tests external-backend signal handling.
`src/cli-workflow.ts`	Exports the workflow dependency contract.
`docs/sbx-integration.md`	Documents backend registration.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 11/11 changed files
Comments generated: 1
Review effort level: Balanced

github-actions · 2026-08-09T04:55:23Z

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-08-09T16:05:45Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-08-09T16:05:45Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-08-09T16:05:46Z

✅ Smoke Claude passed

Generated by Smoke Claude for #7129

github-actions · 2026-08-09T16:05:47Z

❌ Contribution Check failed. Please review the logs for details.

Generated by Contribution Check for #7129

github-actions · 2026-08-09T16:05:48Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #7129

github-actions · 2026-08-09T16:05:48Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 5 domains

The following domains were blocked by the firewall during workflow execution:

msfeed12.pkgs.visualstudio.com
msfeed17.pkgs.visualstudio.com
msfeed2.pkgs.visualstudio.com
msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed12.pkgs.visualstudio.com"
    - "msfeed17.pkgs.visualstudio.com"
    - "msfeed2.pkgs.visualstudio.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-08-09T16:05:48Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-08-09T16:05:48Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-08-09T16:05:49Z

✅ Smoke Gemini completed. All facets verified. 💎

Gemini Engine Smoke Test completed successfully. All tests passed.

💎 Faceted by Smoke Gemini

github-actions · 2026-08-09T16:05:49Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Docker Sbx

github-actions · 2026-08-09T16:05:50Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-08-09T16:05:51Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-08-09T16:05:52Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-08-09T16:05:53Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-08-09T16:05:58Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-08-09T16:07:24Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Non-allowed domain (example.com) blocked: denied=000 (403 CONNECT tunnel failure)

Overall status: PASS — network isolation egress enforcement working as expected. cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T16:07:26Z

Smoke Test: Copilot BYOK (Direct) Mode

✅ GitHub MCP: PR Upgrade gh-aw extension to latest pre-release and recompile workflows #7146 "Upgrade gh-aw extension...", PR Update Runner Doctor with C9 and B20 failure modes #7124 "Update Runner Doctor with C9 and B20 failure modes"
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test
✅ BYOK inference test

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall: PASS

cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T16:07:36Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
gh check	✅ PASS
File status	✅ PASS

Overall result: PASS

Generated by Smoke Claude for #7129 · haiku45 · 59.6 AIC · ⊞ 3.6K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T16:07:41Z

Smoke Test Results

❌ Redis: Could not connect... Temporary failure in name resolution
❌ PostgreSQL pg_isready: no response
❌ PostgreSQL SELECT 1: could not translate host name

Overall: FAIL — host.docker.internal DNS resolution failed inside the AWF sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T16:07:55Z

Smoke Test: Copilot Engine

✅ GitHub MCP (PR Upgrade gh-aw extension to latest pre-release and recompile workflows #7146: Upgrade gh-aw extension to latest pre-release and recompile workflows)
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test

Overall: PASS

cc @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T16:08:40Z

Smoke Test: API Proxy OTel Tracing — Results

✅ Scenario 1 (Module Loading): otel.js loaded successfully, isEnabled() returns true, exports include startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled.
✅ Scenario 2 (Test Suite): 3 suites / 68 tests passed (0 failed) — covers span init, _parseOtlpHeaders, startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan/endSpanError, OTLP serialization, ProxyAwareOtlpExporter, FileSpanExporter.
✅ Scenario 3 (Env Var Forwarding): env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID to the agent; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and trace context vars to api-proxy.
✅ Scenario 4 (Token Tracker Integration): token-tracker-http.js contains the onUsage callback hook point for OTEL.
⚠️ Scenario 5 (OTEL Diagnostics): no spans exported this run — no live LLM API traffic passed through the api-proxy sidecar during this smoke test (expected; module-level tests already validate span creation logic).

Overall: All applicable scenarios passed.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T16:09:17Z

Gemini Engine Smoke Test Results

GitHub MCP Testing: ✅
GitHub.com Connectivity: ✅
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall Status: PASS

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T16:10:01Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	✅ YES
Node.js	v24.18.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: Not all tests passed (ALL_TESTS_PASSED=false) — Node.js version differs between host and chroot environments. smoke-chroot label not applied.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T16:10:04Z

Smoke Test

Merged PRs: "Upgrade gh-aw extension to latest pre-release and recompile workflows"; "Update Runner Doctor with C9 and B20 failure modes"
Queried PRs: "[WIP] Refactor Google provider adapter wrappers to eliminate duplicate code"; "[WIP] Add support for allow-host-ports in services without legacy security"
safeinputs-gh: ❌ missing; gh fallback used
Playwright: ✅
File write/read: ✅
Discussion query: ✅ #7145; comment skipped, no discussions write permission
Build AWF: ❌ npm ci hit 403 on ms-feed-25.pkgs.visualstudio.com
Overall: FAIL

Warning

Firewall blocked 5 domains

The following domains were blocked by the firewall during workflow execution:

msfeed12.pkgs.visualstudio.com
msfeed17.pkgs.visualstudio.com
msfeed2.pkgs.visualstudio.com
msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed12.pkgs.visualstudio.com"
    - "msfeed17.pkgs.visualstudio.com"
    - "msfeed2.pkgs.visualstudio.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T16:10:21Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (ran OK)	✅ PASS
.NET	json-parse	✅	N/A (ran OK)	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

All repositories cloned successfully and all builds/tests completed without errors, including via the Squid HTTP/HTTPS forward proxy (Maven required ~/.m2/settings.xml proxy config as documented).

Generated by Build Test Suite for #7129 · auto · 46.6 AIC · ⊞ 11.5K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-09T16:10:28Z

Smoke Test: Docker Sbx Validation

✅ GitHub MCP connectivity (PRs Upgrade gh-aw extension to latest pre-release and recompile workflows #7146, Update Runner Doctor with C9 and B20 failure modes #7124 fetched)
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test (file confirmed on disk)

Overall: PASS

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings August 9, 2026 01:23

Copilot started reviewing on behalf of lpcox August 9, 2026 01:23 View session

Copilot AI reviewed Aug 9, 2026

View reviewed changes

Comment thread src/container-runtime.ts Outdated

This was referenced Aug 9, 2026

Add Firecracker control-plane preview #7133

Open

Add Firecracker guest execution transport #7135

Open

Integrate Firecracker primary-agent runtime preview #7136

Open

Complete Firecracker preview rollout coverage and distribution #7138

Open

lpcox force-pushed the lpcox-runtime-backend-abstraction branch from 72e0244 to 2ddc5b8 Compare August 9, 2026 16:05

lpcox added the ready-for-aw label Aug 9, 2026

lpcox had a problem deploying to aoai-model August 9, 2026 16:05 — with GitHub Actions Failure

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Aug 9, 2026

github-actions Bot added the smoke-copilot-byok label Aug 9, 2026

github-actions Bot added the smoke-claude label Aug 9, 2026

lpcox temporarily deployed to aoai-model August 9, 2026 16:07 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot label Aug 9, 2026

lpcox temporarily deployed to aoai-model August 9, 2026 16:08 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Aug 9, 2026

[aw] Contribution Check hit engine rate limit (HTTP 429) #7154

Open

github-actions Bot added the smoke-gemini label Aug 9, 2026

github-actions Bot added the build-test label Aug 9, 2026

github-actions Bot added the smoke-docker-sbx label Aug 9, 2026

lpcox and others added 2 commits August 9, 2026 09:33

refactor: abstract external agent runtimes

f7bd954

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Potential fix for pull request finding

e8e68c0

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

lpcox force-pushed the lpcox-runtime-backend-abstraction branch from 2ddc5b8 to e8e68c0 Compare August 9, 2026 16:33

Uh oh!

Conversation

lpcox commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Stack

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation Preview

Uh oh!

github-actions Bot commented Aug 9, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 9, 2026

Uh oh!

github-actions Bot commented Aug 9, 2026

Uh oh!

github-actions Bot commented Aug 9, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Aug 9, 2026

Smoke Test Results

Uh oh!

github-actions Bot commented Aug 9, 2026

Uh oh!

lpcox commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading

github-actions Bot commented Aug 9, 2026 •

edited

Loading