fix: sync src/awf-config-schema.json with docs/awf-config.schema.json by github-actions[bot] · Pull Request #6266 · github/gh-aw-firewall

github-actions · 2026-07-15T16:24:46Z

Summary

This PR fixes schema drift introduced by #6214.

Gap Found

PR	Layer	Issue
#6214	JSON Schema (`src/awf-config-schema.json`)	Updated `docs/awf-config.schema.json` to deprecate `apiProxy.enabled` and update environment descriptions, but did not apply identical changes to `src/awf-config-schema.json`

Fix Applied

Copied docs/awf-config.schema.json → src/awf-config-schema.json to restore identical copies

Changes in `src/awf-config-schema.json`

apiProxy.enabled: Added "deprecated": true and updated description to mark as deprecated
environment description: Removed stale reference to apiProxy.enabled being required for credential exclusion
environment.excludeEnv description: Updated to reflect that LLM API keys are always excluded by the sidecar

Verification Checklist

diff src/awf-config-schema.json docs/awf-config.schema.json → empty (identical)
tsc --noEmit passes
config-file-mapping tests pass
schema validation tests pass

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Config Consistency Auditor · 42.9 AIC · ⊞ 6.1K · ◷

PR #6214 updated docs/awf-config.schema.json to mark apiProxy.enabled as deprecated and update environment descriptions, but did not apply the same changes to src/awf-config-schema.json, causing schema drift. This commit copies the docs schema to src to restore identical copies. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

lpcox · 2026-07-15T18:53:35Z

@copilot fix conflict with main and finish implementation plan

Copilot

Pull request overview

Synchronizes the runtime AWF configuration schema with its documentation counterpart.

Changes:

Marks apiProxy.enabled deprecated.
Updates credential-isolation descriptions to reflect the always-enabled API proxy.

Show a summary per file

File	Description
`src/awf-config-schema.json`	Aligns API proxy and environment schema metadata with the documentation schema.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 0
Review effort level: Medium

…chema-a12bd52b5c20842f # Conflicts: # src/awf-config-schema.json

Copilot · 2026-07-15T18:58:42Z

@copilot fix conflict with main and finish implementation plan

Merged main into this branch and resolved the conflict in src/awf-config-schema.json. The conflict was in the environment description field — accepted main's version (from #6267) since it accurately reflects the new --env override behavior. Both src/awf-config-schema.json and docs/awf-config.schema.json are now identical. All 242 config/schema tests pass.

github-actions · 2026-07-15T18:59:47Z

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-15T19:00:20Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-15T19:00:20Z

✅ Smoke Claude passed

github-actions · 2026-07-15T19:00:24Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

github-actions · 2026-07-15T19:00:25Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-15T19:00:25Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-15T19:00:25Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-15T19:00:27Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-07-15T19:00:28Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

github-actions · 2026-07-15T19:00:32Z

✅ Smoke Gemini completed. All facets verified. 💎

Attempting to list merged PRs and verify connectivity

github-actions · 2026-07-15T19:00:33Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-15T19:00:38Z

✅ Contribution Check completed successfully!

github-actions · 2026-07-15T19:00:41Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-15T19:01:08Z

🦎🟣 Smoke gVisor Claude completed. gVisor + Claude smoke test passed. ✅

github-actions · 2026-07-15T19:01:17Z

🦎 Smoke gVisor completed. gVisor smoke test passed. ✅

github-actions · 2026-07-15T19:01:28Z

🐳🔮 Smoke Docker Sbx Codex completed. Docker sbx + Codex smoke test passed. ✅

github-actions · 2026-07-15T19:01:33Z

🦎🔮 Smoke gVisor Codex completed. gVisor + Codex smoke test passed. ✅

github-actions · 2026-07-15T19:04:20Z

Thanks for keeping the two schema copies in sync. Per the Contributing Code and Testing sections of CONTRIBUTING.md, please add or update focused tests for the schema behavior changed here, including the deprecated apiProxy.enabled metadata and the environment descriptions, and run the relevant test suite before merging. The PR checklist currently leaves the TypeScript, config-file-mapping, and schema-validation checks unchecked, so please either complete those checks or explain why they are not applicable.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Contribution Check for #6266 · 3.45 AIC · ⊞ 19.2K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-15T19:04:23Z

Smoke Test: Copilot PAT Auth

🔌 MCP connectivity: ✅
🌐 GitHub.com HTTP: ✅ 200
📄 File write/read: ⚠️ template vars unexpanded in workflow

Overall: PASS
Auth mode: PAT (COPILOT_GITHUB_TOKEN) | cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-15T19:04:31Z

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: PASS ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6266 · 55.5 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-15T19:04:39Z

🔬 Smoke Test Results

Test	Status
GitHub MCP Connectivity	✅
GitHub.com HTTP	⚠️ (pre-step vars not substituted)
File Write/Read	⚠️ (pre-step vars not substituted)

Overall: PASS

@lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-15T19:05:04Z

Smoke Test: Services Connectivity

Redis PING: ❌ Network unreachable
PostgreSQL pg_isready: ❌ No response
PostgreSQL SELECT 1: ❌ Network unreachable

Overall: FAIL — host.docker.internal (172.17.0.1) unreachable. Service containers may not be running or host bridge is inaccessible.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-15T19:05:08Z

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
1. Module Loading	✅ Pass	`otel.js` loads successfully; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled` + internals
2. Test Suite	✅ Pass	59 tests passed across 2 suites (`otel.test.js`, `otel-fanout.test.js`)
3. Env Var Forwarding	✅ Pass	`src/services/api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME`
4. Token Tracker Integration	✅ Pass	`onUsage` callback exists in `token-tracker-http.js` as the OTEL hook point
5. OTEL Diagnostics	✅ Pass	`FileSpanExporter` writes NDJSON to `/var/log/api-proxy/otel.jsonl` as fallback; OTLP export routes through Squid proxy

All 5 scenarios pass. OTEL tracing integration is working correctly.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-15T19:05:17Z

Smoke Test: Copilot BYOK (Direct) Mode

Test	Result
GitHub MCP connectivity	OK
GitHub.com HTTP	pre-fetch data unavailable
File write/read	pre-fetch data unavailable
BYOK inference (this response)	PASS

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy to api.githubcopilot.com

Overall: PARTIAL - BYOK inference confirmed; pre-fetched test data not expanded by workflow.

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-15T19:05:23Z

🦎 gVisor Smoke Test Results

🦎 gVisor runtime: unconfirmed (running runc — expected until runtime plumbing is added)
✅ GitHub MCP: connected
✅ GitHub.com connectivity: reachable
✅ File write/read: confirmed
✅ Network isolation: example.com blocked

Overall: PASS @lpcox

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

example.com
host.docker.internal

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "host.docker.internal"

See Network Configuration for more information.

🦎 gVisor smoke test by Smoke gVisor
_{Add label test-gvisor to run again}

github-actions · 2026-07-15T19:06:07Z

Smoke Test Results: MCP ❌, Connectivity ❌, Files ✅, Bash ✅. Overall: FAIL.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-15T19:06:09Z

🦎🟣 gVisor + Claude Smoke Test

🦎🟣 gVisor + Claude runtime: confirmed (kernel 4.4.0 Improve links in readme to AW project #1 SMP gVisor signature)
✅ GitHub.com connectivity: HTTP 200
✅ File write/read test: passed
✅ Network isolation: example.com blocked (000)
✅ GitHub MCP: server reachable

Overall status: PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

example.com
host.docker.internal

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "host.docker.internal"

See Network Configuration for more information.

🦎🟣 gVisor + Claude smoke test by Smoke gVisor Claude
_{Add label test-gvisor-claude to run again}

github-actions · 2026-07-15T19:06:31Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Note (Java): Maven could not create /home/runner/.m2/repository due to permissions (owned by root). Tests were run successfully using -Dmaven.repo.local=/tmp/gh-aw/agent/.m2/repository as a workaround.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6266 · 29.6 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-15T19:07:21Z

🦎🔮 gVisor + Codex runtime: confirmed\n✅ /proc/version + dmesg\n✅ GitHub MCP connectivity\n✅ github.com HTTP check\n✅ file read/write check\n✅ example.com blocked\nOverall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

172.30.0.1

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "172.30.0.1"

See Network Configuration for more information.

🦎🔮 gVisor + Codex smoke test by Smoke gVisor Codex
_{Add label test-gvisor-codex to run again}

github-actions · 2026-07-15T19:07:34Z

🔥 Smoke Test: Docker Sbx — PASS

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	✅
File write/read	✅ `smoke-test-docker-sbx-29442801606.txt` confirmed

Overall: PASS — @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-07-15T19:07:46Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed — Python and Node.js versions differ between host and chroot.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-15T19:08:28Z

🐳🔮 Docker sbx + Codex
✅ GitHub.com connectivity
✅ File write/read
❌ GitHub MCP PR check
❌ example.com isolation
Overall: FAIL

🐳🔮 Docker sbx + Codex smoke test by Smoke Docker Sbx Codex
_{Add label test-docker-sbx-codex to run again}

github-actions · 2026-07-15T19:09:28Z

🐳🟣 Docker sbx + Claude

✅ GitHub MCP: list_pull_requests responded (secrecy-filtered)
✅ github.com connectivity: HTTP 200
✅ File write/read: smoke file verified in /tmp/gh-aw/agent/
❌ Network isolation: example.com returned HTTP 200 (reachable, not in allowlist)

Overall: FAIL — example.com was not blocked despite absence from the Squid allowlist.

🐳🟣 Docker sbx + Claude smoke test by Smoke Docker Sbx Claude
_{Add label test-docker-sbx-claude to run again}

github-actions Bot added automation config-consistency labels Jul 15, 2026

lpcox marked this pull request as ready for review July 15, 2026 18:53

Copilot AI review requested due to automatic review settings July 15, 2026 18:53

Copilot started reviewing on behalf of lpcox July 15, 2026 18:53 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 15, 2026 18:55 View session

Merge remote-tracking branch 'origin/main' into fix/sync-awf-config-s…

1f2599f

…chema-a12bd52b5c20842f # Conflicts: # src/awf-config-schema.json

Copilot finished work on behalf of lpcox July 15, 2026 18:59

Copilot AI requested a review from lpcox July 15, 2026 18:59

lpcox added the ready-for-aw label Jul 15, 2026

lpcox had a problem deploying to aoai-model July 15, 2026 19:00 — with GitHub Actions Failure

lpcox temporarily deployed to aoai-model July 15, 2026 19:04 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-pat label Jul 15, 2026

github-actions Bot added the smoke-claude label Jul 15, 2026

github-actions Bot added the smoke-copilot label Jul 15, 2026

lpcox deployed to aoai-model July 15, 2026 19:05 — with GitHub Actions Active

github-actions Bot added the smoke-gvisor label Jul 15, 2026

github-actions Bot added the smoke-gvisor-claude label Jul 15, 2026

github-actions Bot added build-test smoke-gvisor-codex labels Jul 15, 2026

github-actions Bot added the smoke-docker-sbx label Jul 15, 2026

Uh oh!

Conversation

github-actions Bot commented Jul 15, 2026

Summary

Gap Found

Fix Applied

Changes in src/awf-config-schema.json

Verification Checklist

Uh oh!

lpcox commented Jul 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Copilot AI commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 15, 2026

Smoke Test: Copilot PAT Auth

Uh oh!

github-actions Bot commented Jul 15, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 15, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Jul 15, 2026

Changes in `src/awf-config-schema.json`

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading

github-actions Bot commented Jul 15, 2026 •

edited

Loading