-
Notifications
You must be signed in to change notification settings - Fork 6
fix: restore HTTPS_PROXY and fix smoke-chroot checkout #530
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
Chroot tests failed Smoke Chroot failed - See logs for details. |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 82.10% | 82.07% | 📉 -0.03% |
| Statements | 82.14% | 82.10% | 📉 -0.04% |
| Functions | 81.95% | 81.95% | ➡️ +0.00% |
| Branches | 75.44% | 75.34% | 📉 -0.10% |
📁 Per-file Coverage Changes (1 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/docker-manager.ts |
82.9% → 82.7% (-0.17%) | 82.2% → 82.0% (-0.16%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
Go Build Test Results
Overall: PASS All Go projects successfully downloaded dependencies and passed their tests.
|
Deno Build Test Results
Overall: ✅ PASS All Deno tests passed successfully.
|
Smoke Test ResultsLast 2 Merged PRs:
Tests:
Overall Status: PASS cc @Mossaka
|
Node.js Build Test Results
Overall: ✅ PASS All Node.js projects installed dependencies successfully and passed their test suites.
|
C++ Build Test Results
Overall: PASS ✅ All C++ projects built successfully.
|
Smoke Test: Claude Engine - PASS ✅Last 2 merged PRs:
Test results:
Status: PASS
|
Build Test: Bun - FAILED ❌
Overall: FAIL ❌ Error DetailsBun Installation: ✅ Successfully installed v1.3.8 Environment Issue: Bun is crashing in the execution environment with core dumps:
Root Cause: The execution environment appears to be missing critical system resources:
This appears to be a compatibility issue between Bun v1.3.8 and the restricted container environment. Bun may require full Linux kernel interfaces (procfs) that are not available in this execution context.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR fixes two critical regressions introduced by recent PRs #524 and #527 that broke CI workflows on the main branch.
Changes:
- Restores
HTTPS_PROXYenvironment variable in the agent container to fix HTTPS connectivity (required for CONNECT tunneling through Squid's forward proxy port 3128) - Removes
HTTPS_PROXY/https_proxyfromEXCLUDED_ENV_VARSset (keeping onlyHTTP_PROXY/http_proxyexcluded since HTTP uses iptables intercept mode) - Updates entrypoint.sh logging to clearly distinguish between HTTP intercept mode and HTTPS forward proxy mode
- Fixes smoke-chroot workflow by replacing sparse checkout with full repository checkout
- Updates test assertions to reflect that
HTTPS_PROXYis now explicitly set by AWF
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/docker-manager.ts | Restores HTTPS_PROXY setting and removes https_proxy from EXCLUDED_ENV_VARS |
| src/docker-manager.test.ts | Updates tests to verify HTTPS_PROXY is set and HTTP_PROXY remains excluded |
| containers/agent/entrypoint.sh | Improves proxy configuration logging to distinguish HTTP intercept mode from HTTPS forward proxy |
| .github/workflows/smoke-chroot.md | Adds full checkout step before build to ensure src/ directory is available for npm run build |
| .github/workflows/smoke-chroot.lock.yml | Recompiled workflow with full checkout instead of sparse checkout, removes unnecessary permission fix steps |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| 'HTTP_PROXY', // Intercept mode handles routing; explicit proxy is unreachable | ||
| 'HTTPS_PROXY', // Intercept mode handles routing; explicit proxy is unreachable | ||
| 'HTTP_PROXY', // Intercept mode handles HTTP routing via iptables DNAT | ||
| 'http_proxy', // Lowercase variant |
Copilot
AI
Feb 5, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The lowercase variant https_proxy should also be added to the EXCLUDED_ENV_VARS set. While HTTPS_PROXY is explicitly set by AWF, if a user runs with --env-all and has https_proxy set on their host, it will leak into the container and could potentially interfere with the explicit HTTPS_PROXY setting. Some tools check both uppercase and lowercase variants, and having both set with different values could cause confusion or incorrect behavior.
Add 'https_proxy' to the EXCLUDED_ENV_VARS set to match the pattern used for HTTP_PROXY/http_proxy.
| 'http_proxy', // Lowercase variant | |
| 'http_proxy', // Lowercase variant | |
| 'https_proxy', // Lowercase HTTPS proxy variant |
| // HTTP_PROXY must NOT leak from host (intercept mode handles HTTP routing) | ||
| expect(env.HTTP_PROXY).toBeUndefined(); | ||
| expect(env.HTTPS_PROXY).toBeUndefined(); | ||
| expect(env.http_proxy).toBeUndefined(); | ||
| expect(env.https_proxy).toBeUndefined(); | ||
| // HTTPS_PROXY is set by AWF (not from host) for CONNECT tunneling | ||
| expect(env.HTTPS_PROXY).toBe('http://172.30.0.10:3128'); |
Copilot
AI
Feb 5, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The test should verify that https_proxy (lowercase) doesn't leak from the host when --env-all is used, similar to how http_proxy is checked. Add an assertion: expect(env.https_proxy).toBeUndefined(); after line 971 to ensure the lowercase variant is also properly excluded.
05d4767 to
0305b32
Compare
|
Chroot tests failed Smoke Chroot failed - See logs for details. |
|
📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident... |
|
💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges... |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
📰 DEVELOPING STORY: Smoke Copilot reports was cancelled. Our correspondents are investigating the incident... |
|
Chroot tests failed Smoke Chroot was cancelled - See logs for details. |
b8d305b to
0bc514b
Compare
|
Chroot tests failed Smoke Chroot was cancelled - See logs for details. |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 82.10% | 82.07% | 📉 -0.03% |
| Statements | 82.14% | 82.10% | 📉 -0.04% |
| Functions | 81.95% | 81.95% | ➡️ +0.00% |
| Branches | 75.44% | 75.34% | 📉 -0.10% |
📁 Per-file Coverage Changes (1 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/docker-manager.ts |
82.9% → 82.7% (-0.17%) | 82.2% → 82.0% (-0.16%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
|
📰 DEVELOPING STORY: Smoke Copilot reports was cancelled. Our correspondents are investigating the incident... |
|
Smoke Test Results Last 2 merged PRs:
✅ GitHub MCP (PR fetch) Status: PASS
|
Security Review: HTTPS_PROXY RestorationI've reviewed PR #530 for security implications. The changes primarily fix CI regressions and are generally safe, but there is one security concern that requires clarification:
|
0bc514b to
c2fc697
Compare
|
💫 TO BE CONTINUED... Smoke Claude was cancelled! Our hero faces unexpected challenges... |
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
|
📰 DEVELOPING STORY: Smoke Copilot reports was cancelled. Our correspondents are investigating the incident... |
|
Chroot tests failed Smoke Chroot was cancelled - See logs for details. |
Four fixes for CI failures introduced by recent agent-authored PRs: 1. Restore HTTPS_PROXY in agent container (fixes #529) - HTTPS requires CONNECT method through Squid port 3128 - Only HTTP_PROXY should be removed (intercept mode handles HTTP) 2. Copy container /etc/hosts to chroot (fixes Smoke Copilot) - Docker extra_hosts (host.docker.internal) only in container /etc/hosts - Chroot sees host's /etc/hosts which lacks this entry - Backup/copy/restore pattern like resolv.conf 3. Add .copilot directory permissions step (fixes Smoke Chroot) - sudo install creates root-owned ~/.copilot - Pre-create with runner:runner ownership in smoke-chroot.md 4. Use setup-bun action for Build Test Bun (fixes core dump) - Bun crashes when installed inside chroot (restricted /proc) - Install on host via oven-sh/setup-bun@v2, available in chroot via PATH All smoke/build-test .md files include actions/checkout step for full repo checkout (needed by postprocess local build). Fixes #529 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
c2fc697 to
3939d46
Compare
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
Smoke Test Results: Claude EngineLast 2 Merged PRs:
Test Results:
Overall Status: PASS ✅
|
Reverts the following PRs which introduced unnecessary complexity: - #520: fix: enable Squid intercept mode for NAT-redirected traffic - v0.13.5 release: chore(release): bump version to 0.13.5 - #524: fix: remove HTTP_PROXY/HTTPS_PROXY env vars from agent container - #526: chore: recompile workflow lock files for AWF v0.13.5 - #527: fix: recompile lock files with release action mode - #522: fix: mount /etc/hosts in chroot and fix HTTP blocking test - #530: fix: restore HTTPS_PROXY, fix chroot hosts/permissions, fix Bun crash - v0.13.6 release: chore(release): bump version to 0.13.6 The intercept mode (#520) was introduced to fix Codex failing with HTTP_PROXY, but the simpler fix is to just not set HTTP_PROXY for Codex. The intercept mode introduced a cascade of breakage: - HTTPS can't be transparently intercepted (needs CONNECT method) - Image version bumps required lock file recompilation - host.docker.internal traffic crashed Squid under load - Multiple PRs needed to fix each regression This reverts to the pre-#520 explicit proxy mode (HTTP_PROXY/HTTPS_PROXY pointing to Squid port 3128) which worked for all engines. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Reverts the following PRs which introduced unnecessary complexity: - #520: fix: enable Squid intercept mode for NAT-redirected traffic - v0.13.5 release: chore(release): bump version to 0.13.5 - #524: fix: remove HTTP_PROXY/HTTPS_PROXY env vars from agent container - #526: chore: recompile workflow lock files for AWF v0.13.5 - #527: fix: recompile lock files with release action mode - #522: fix: mount /etc/hosts in chroot and fix HTTP blocking test - #530: fix: restore HTTPS_PROXY, fix chroot hosts/permissions, fix Bun crash - v0.13.6 release: chore(release): bump version to 0.13.6 The intercept mode (#520) was introduced to fix Codex failing with HTTP_PROXY, but the simpler fix is to just not set HTTP_PROXY for Codex. The intercept mode introduced a cascade of breakage: - HTTPS can't be transparently intercepted (needs CONNECT method) - Image version bumps required lock file recompilation - host.docker.internal traffic crashed Squid under load - Multiple PRs needed to fix each regression This reverts to the pre-#520 explicit proxy mode (HTTP_PROXY/HTTPS_PROXY pointing to Squid port 3128) which worked for all engines. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Summary
Fixes two regressions from recent agent-authored PRs that are breaking CI on main.
Fix 1: Restore HTTPS_PROXY (fixes Examples Test, Chroot Edge Cases, Chroot Package Managers)
PR #524 removed both
HTTP_PROXYandHTTPS_PROXYfrom the agent container. This was over-broad:HTTP_PROXYneeded.CONNECTmethod through Squid's forward-proxy port 3128. DNAT to the intercept port can't handle TLS.HTTPS_PROXYis required.Changes:
HTTPS_PROXYin the agent environment pointing tosquid:3128HTTPS_PROXY/https_proxyfrom theEXCLUDED_ENV_VARSset (keepHTTP_PROXY/http_proxyexcluded)Fix 2: Fix Smoke Chroot sparse checkout (fixes Smoke Chroot
tscbuild)PR #527 recompiled lock files, but the smoke-chroot workflow got compiled with a sparse checkout (
.github/.agentsonly). The agent job then runsnpm ci && npm run buildwhich needssrc/,package.json, etc.Changes:
actions/checkoutstep tosmoke-chroot.mdsource → compiler skips sparse checkoutsmoke-chroot.lock.ymlwith--action-mode release --action-tag v0.42.0Fixes #529
Test plan
🤖 Generated with Claude Code