fix(ci): match staged KVM processes by lpcox · Pull Request #7929 · github/gh-aw-firewall

lpcox · 2026-08-31T21:33:29Z

Summary

remove the source artifact-directory prefix from live Cloud Hypervisor and virtiofsd probes
match the verified per-run snapshot copies that AWF actually executes
retain self-excluding pgrep expressions and argument anchors
update regression coverage with a staged virtiofsd command line

Context

#7927 was externally merged while its labeled live-KVM run was still executing. That run proved the self-excluding path-specific expression no longer matched itself, but also revealed it could not match AWF's staged runtime copy. This follow-up preserves the narrow probe fix while matching the real command line.

Validation

npm test -- --runInBand scripts/ci/cloud-hypervisor-ci-scripts.test.ts scripts/ci/test-cloud-hypervisor-workflow.test.ts
bash -n scripts/ci/cloud-hypervisor-live-smoke.sh
npm run build
npm run lint
npm test -- --runInBand

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-08-31T21:34:14Z

🚀 Security Guard has started processing this pull request

Copilot

Copilot review overview

🟡 Changes recommended

The system-wide probes can mistake unrelated virtualization processes for AWF processes, causing false failures or liveness results.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1

New issues introduced by this change (1)

Severity	Finding
	`scripts/ci/cloud-hypervisor-live-smoke.sh` — This system-wide pattern now treats any host `virtiofsd` using `--shared-dir` as residue from this…

What changed in this PR

Updates live-KVM process probes to recognize AWF’s staged Cloud Hypervisor artifacts.

Changes:

Removes source artifact-directory prefixes from process probes.
Adds staged virtiofsd regression coverage.

File	Description
`scripts/ci/cloud-hypervisor-live-smoke.sh`	Broadens residue and liveness probes.
`scripts/ci/cloud-hypervisor-ci-scripts.test.ts`	Updates process-probe assertions.

Suppressed comments (2)

scripts/ci/cloud-hypervisor-live-smoke.sh:572

The broadened probe can be satisfied by any unrelated Cloud Hypervisor process on the host. Because the surrounding checks are also global, that can make this loop conclude the crash fixture is ready and SIGKILL the AWF owner before this run's VMM has started. Match the verified AWF snapshot path under /run/awf-cloud-hypervisor/trusted-artifacts/run-* instead of any executable named cloud-hypervisor.

     sudo pgrep -f '[c]loud-hypervisor --api-socket' >/dev/null; then

scripts/ci/cloud-hypervisor-live-smoke.sh:594

This check no longer proves that the VMM belonging to the killed AWF run survived; any host process whose command line contains cloud-hypervisor --api-socket makes it pass. Scope the probe to AWF's trusted per-run snapshot hierarchy so a foreign VMM cannot mask premature termination of the process under test.

sudo pgrep -f '[c]loud-hypervisor --api-socket' >/dev/null || {

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-08-31T21:37:24Z

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-08-31T21:39:00Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.09%	93.11%	📈 +0.02%
Statements	91.73%	91.75%	📈 +0.02%
Functions	92.19%	92.19%	➡️ +0.00%
Branches	85.43%	85.44%	➡️ +0.01%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-08-31T21:47:07Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-08-31T21:47:10Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Docker Sbx

github-actions · 2026-08-31T21:47:12Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-08-31T21:47:12Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-08-31T21:47:12Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-08-31T21:47:12Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-08-31T21:47:14Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #7929

github-actions · 2026-08-31T21:47:15Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-08-31T21:47:17Z

✅ Contribution Check completed successfully!

Contribution check complete: the PR description is clear, references the related issue/PR context, and the change stays within the correct scripts/ci/ and .github/workflows/ areas. No CONTRIBUTING.md issues requiring a review comment were found.

Generated by Contribution Check for #7929

github-actions · 2026-08-31T21:47:19Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-08-31T21:47:20Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-08-31T21:47:24Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-08-31T21:47:26Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-08-31T21:48:04Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-08-31T21:48:06Z

✅ Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #7929

github-actions · 2026-08-31T21:50:25Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Blocked domain (example.com) denied: CONNECT tunnel failed (403)

Overall: PASS

@lpcox network isolation egress enforcement verified.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T21:50:47Z

Smoke Test: Copilot BYOK (Direct) Mode — ✅ PASS

Test	Result
GitHub MCP Connectivity	✅
github.com HTTP 200	✅
File Write/Read	✅
BYOK Inference Path	✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com.
All pre-computed tests verified successfully.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T21:50:51Z

Smoke Test: GitHub Actions Services Connectivity — FAIL

Redis PING: ❌ (Temporary failure in name resolution)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (could not translate host name "host.docker.internal")

Overall: FAIL — host.docker.internal did not resolve in the sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T21:51:21Z

Smoke Test: Copilot Engine — @lpcox

MCP connectivity (PR fix: avoid self-matching KVM process probes #7927 fetch): ✅
github.com HTTP: ✅ (200)
File write/read: ✅

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T21:51:38Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.19.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environments. Label not added since not all tests passed.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T21:51:44Z

Smoke Test: Docker Sbx — @lpcox

PR fix: avoid self-matching KVM process probes #7927: fix: avoid self-matching KVM process probes
PR fix: stabilize post-merge KVM checks #7922: fix: stabilize post-merge KVM checks

✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test
❌ GitHub MCP: live query returned different PRs (#5/#6) than pre-fetched data (#7927/#7922)

Overall: FAIL

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T21:51:46Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
`gh` check	✅ PASS
File status	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #7929 · claude · haiku45 · 58.3 AIC · ⊞ 4.5K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T21:52:41Z

fix: avoid self-matching KVM process probes (#7927)
chore: upgrade gh-aw workflows (#7885)

✅ Playwright title check
✅ File write/readback
✅ npm ci
✅ npm run build
❌ safeinputs-gh PR query/review
❌ discussion query/comment
Overall: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T21:52:46Z

@lpcox

✅ fix: avoid self-matching KVM process probes (#7927)
✅ fix: stabilize post-merge KVM checks (#7922)
✅ GitHub.com connectivity
✅ agent file I/O
✅ BYOK inference path

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy -> Azure OpenAI (Foundry, o4-mini-aw)

Overall: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T21:52:46Z

fix: avoid self-matching KVM process probes
fix: stabilize post-merge KVM checks
MCP Testing: ❌ (expected #7927/#7922 vs #7929/#7928)
GitHub.com Connectivity: ✅
File Write/Read: ✅
BYOK Inference: ✅
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
Overall: FAIL
@lpcox

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T21:52:50Z

Smoke Test: API Proxy OTEL Tracing — Results

✅ Scenario 1 (Module Loading): otel.js loads successfully, exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, plus internal exporter/parsing helpers.
✅ Scenario 2 (Test Suite): otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js — 3 suites, 68/68 tests passed.
✅ Scenario 3 (Env Var Forwarding): src/services/agent-environment/env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID/COPILOT_OTEL_FILE_EXPORTER_PATH into the agent; src/services/api-proxy-env-config.ts::buildOtelEnv() forwards OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, trace/parent-span IDs, and sets OTEL_SERVICE_NAME into the api-proxy container.
✅ Scenario 4 (Token Tracker Integration): onUsage callback present in token-tracker-http.js (invoked at line ~408) as the documented OTEL hook point; confirmed live in this run's token-usage.jsonl (request tracked with token/credit attributes).
✅ Scenario 5 (OTEL Diagnostics): The workflow-level trace exported one gh-aw.agent.setup span to /tmp/gh-aw/otel.jsonl with correct GenAI/resource attributes; no api-proxy sub-spans appeared in this run, consistent with graceful degradation when no OTLP endpoint is configured for the sidecar (Scenario 6 behavior) — no errors observed.

Overall: all scenarios pass or behave as expected for current development state.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-08-31T21:53:46Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (run OK)	✅ PASS
.NET	json-parse	✅	N/A (run OK)	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	ok	✅ PASS
Java	caffeine	✅	ok	✅ PASS
Node.js	clsx	✅	all passed	✅ PASS
Node.js	execa	✅	all passed	✅ PASS
Node.js	p-limit	✅	all passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

Java: Maven's default ~/.m2 was root-owned/not writable, so -Dmaven.repo.local was used to point at a writable local repo (compile/test both succeeded).
All repositories cloned successfully; no CLONE_FAILED cases.

Generated by Build Test Suite for #7929 · copilot · auto · 54.3 AIC · ⊞ 12K · ◷
_{Add label ready-for-aw to run again}

lpcox and others added 3 commits August 31, 2026 14:00

fix: avoid self-matching KVM process probes

473d5ec

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

fix(ci): match staged KVM processes

de45d51

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Merge current main into KVM probe fix

e3e15c6

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings August 31, 2026 21:33

lpcox added the cloud-hypervisor-kvm Trigger the Cloud Hypervisor live-KVM smoke/security suite label Aug 31, 2026

Copilot started reviewing on behalf of lpcox August 31, 2026 21:34 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Comment thread scripts/ci/cloud-hypervisor-live-smoke.sh Outdated

fix(ci): scope staged KVM process probes

af8ad41

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

lpcox added the ready-for-aw label Aug 31, 2026

lpcox deployed to aoai-model August 31, 2026 21:47 — with GitHub Actions Active

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Aug 31, 2026

github-actions Bot added the smoke-copilot-byok label Aug 31, 2026

github-actions Bot added the smoke-copilot label Aug 31, 2026

github-actions Bot added the smoke-claude label Aug 31, 2026

lpcox deployed to aoai-model August 31, 2026 21:52 — with GitHub Actions Active

github-actions Bot added smoke-copilot-byok-aoai-apikey smoke-copilot-byok-aoai-entra labels Aug 31, 2026

lpcox deployed to aoai-model August 31, 2026 21:52 — with GitHub Actions Active

github-actions Bot added the build-test label Aug 31, 2026

lpcox merged commit 037c1fc into main Aug 31, 2026
161 of 163 checks passed

lpcox deleted the lpcox-fix-kvm-self-matching-probes branch August 31, 2026 22:20

lpcox mentioned this pull request Aug 31, 2026

fix(cloud-hypervisor): limit device ACL lifetime #7931

Merged

github-actions Bot mentioned this pull request Aug 31, 2026

Unexport LINUX_CAPABILITY_MAP from capability-filter.ts #7928

Merged

Uh oh!

Conversation

lpcox commented Aug 31, 2026

Summary

Context

Validation

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Smoke Test: Copilot BYOK (Direct) Mode — ✅ PASS

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026

Chroot Version Comparison Results

Uh oh!

github-actions Bot commented Aug 31, 2026

Uh oh!

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading

github-actions Bot commented Aug 31, 2026 •

edited

Loading