fix: restore HTTPS_PROXY and fix smoke-chroot checkout#530
Conversation
|
Chroot tests failed Smoke Chroot failed - See logs for details. |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 82.10% | 82.07% | 📉 -0.03% |
| Statements | 82.14% | 82.10% | 📉 -0.04% |
| Functions | 81.95% | 81.95% | ➡️ +0.00% |
| Branches | 75.44% | 75.34% | 📉 -0.10% |
📁 Per-file Coverage Changes (1 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/docker-manager.ts |
82.9% → 82.7% (-0.17%) | 82.2% → 82.0% (-0.16%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
Go Build Test Results
Overall: PASS All Go projects successfully downloaded dependencies and passed their tests.
|
Deno Build Test Results
Overall: ✅ PASS All Deno tests passed successfully.
|
Smoke Test ResultsLast 2 Merged PRs:
Tests:
Overall Status: PASS cc @Mossaka
|
Node.js Build Test Results
Overall: ✅ PASS All Node.js projects installed dependencies successfully and passed their test suites.
|
C++ Build Test Results
Overall: PASS ✅ All C++ projects built successfully.
|
Smoke Test: Claude Engine - PASS ✅Last 2 merged PRs:
Test results:
Status: PASS
|
Build Test: Bun - FAILED ❌
Overall: FAIL ❌ Error DetailsBun Installation: ✅ Successfully installed v1.3.8 Environment Issue: Bun is crashing in the execution environment with core dumps:
Root Cause: The execution environment appears to be missing critical system resources:
This appears to be a compatibility issue between Bun v1.3.8 and the restricted container environment. Bun may require full Linux kernel interfaces (procfs) that are not available in this execution context.
|
There was a problem hiding this comment.
Pull request overview
This PR fixes two critical regressions introduced by recent PRs #524 and #527 that broke CI workflows on the main branch.
Changes:
- Restores
HTTPS_PROXYenvironment variable in the agent container to fix HTTPS connectivity (required for CONNECT tunneling through Squid's forward proxy port 3128) - Removes
HTTPS_PROXY/https_proxyfromEXCLUDED_ENV_VARSset (keeping onlyHTTP_PROXY/http_proxyexcluded since HTTP uses iptables intercept mode) - Updates entrypoint.sh logging to clearly distinguish between HTTP intercept mode and HTTPS forward proxy mode
- Fixes smoke-chroot workflow by replacing sparse checkout with full repository checkout
- Updates test assertions to reflect that
HTTPS_PROXYis now explicitly set by AWF
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/docker-manager.ts | Restores HTTPS_PROXY setting and removes https_proxy from EXCLUDED_ENV_VARS |
| src/docker-manager.test.ts | Updates tests to verify HTTPS_PROXY is set and HTTP_PROXY remains excluded |
| containers/agent/entrypoint.sh | Improves proxy configuration logging to distinguish HTTP intercept mode from HTTPS forward proxy |
| .github/workflows/smoke-chroot.md | Adds full checkout step before build to ensure src/ directory is available for npm run build |
| .github/workflows/smoke-chroot.lock.yml | Recompiled workflow with full checkout instead of sparse checkout, removes unnecessary permission fix steps |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| 'HTTP_PROXY', // Intercept mode handles routing; explicit proxy is unreachable | ||
| 'HTTPS_PROXY', // Intercept mode handles routing; explicit proxy is unreachable | ||
| 'HTTP_PROXY', // Intercept mode handles HTTP routing via iptables DNAT | ||
| 'http_proxy', // Lowercase variant |
There was a problem hiding this comment.
The lowercase variant https_proxy should also be added to the EXCLUDED_ENV_VARS set. While HTTPS_PROXY is explicitly set by AWF, if a user runs with --env-all and has https_proxy set on their host, it will leak into the container and could potentially interfere with the explicit HTTPS_PROXY setting. Some tools check both uppercase and lowercase variants, and having both set with different values could cause confusion or incorrect behavior.
Add 'https_proxy' to the EXCLUDED_ENV_VARS set to match the pattern used for HTTP_PROXY/http_proxy.
| 'http_proxy', // Lowercase variant | |
| 'http_proxy', // Lowercase variant | |
| 'https_proxy', // Lowercase HTTPS proxy variant |
| // HTTP_PROXY must NOT leak from host (intercept mode handles HTTP routing) | ||
| expect(env.HTTP_PROXY).toBeUndefined(); | ||
| expect(env.HTTPS_PROXY).toBeUndefined(); | ||
| expect(env.http_proxy).toBeUndefined(); | ||
| expect(env.https_proxy).toBeUndefined(); | ||
| // HTTPS_PROXY is set by AWF (not from host) for CONNECT tunneling | ||
| expect(env.HTTPS_PROXY).toBe('http://172.30.0.10:3128'); |
There was a problem hiding this comment.
The test should verify that https_proxy (lowercase) doesn't leak from the host when --env-all is used, similar to how http_proxy is checked. Add an assertion: expect(env.https_proxy).toBeUndefined(); after line 971 to ensure the lowercase variant is also properly excluded.
05d4767 to
0305b32
Compare
|
Chroot tests failed Smoke Chroot failed - See logs for details. |
|
📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident... |
|
💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges... |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
📰 DEVELOPING STORY: Smoke Copilot reports was cancelled. Our correspondents are investigating the incident... |
|
Chroot tests failed Smoke Chroot was cancelled - See logs for details. |
b8d305b to
0bc514b
Compare
|
Chroot tests failed Smoke Chroot was cancelled - See logs for details. |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 82.10% | 82.07% | 📉 -0.03% |
| Statements | 82.14% | 82.10% | 📉 -0.04% |
| Functions | 81.95% | 81.95% | ➡️ +0.00% |
| Branches | 75.44% | 75.34% | 📉 -0.10% |
📁 Per-file Coverage Changes (1 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/docker-manager.ts |
82.9% → 82.7% (-0.17%) | 82.2% → 82.0% (-0.16%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
|
📰 DEVELOPING STORY: Smoke Copilot reports was cancelled. Our correspondents are investigating the incident... |
|
Smoke Test Results Last 2 merged PRs:
✅ GitHub MCP (PR fetch) Status: PASS
|
Security Review: HTTPS_PROXY RestorationI've reviewed PR #530 for security implications. The changes primarily fix CI regressions and are generally safe, but there is one security concern that requires clarification:
|
0bc514b to
c2fc697
Compare
|
💫 TO BE CONTINUED... Smoke Claude was cancelled! Our hero faces unexpected challenges... |
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
|
📰 DEVELOPING STORY: Smoke Copilot reports was cancelled. Our correspondents are investigating the incident... |
|
Chroot tests failed Smoke Chroot was cancelled - See logs for details. |
Four fixes for CI failures introduced by recent agent-authored PRs: 1. Restore HTTPS_PROXY in agent container (fixes #529) - HTTPS requires CONNECT method through Squid port 3128 - Only HTTP_PROXY should be removed (intercept mode handles HTTP) 2. Copy container /etc/hosts to chroot (fixes Smoke Copilot) - Docker extra_hosts (host.docker.internal) only in container /etc/hosts - Chroot sees host's /etc/hosts which lacks this entry - Backup/copy/restore pattern like resolv.conf 3. Add .copilot directory permissions step (fixes Smoke Chroot) - sudo install creates root-owned ~/.copilot - Pre-create with runner:runner ownership in smoke-chroot.md 4. Use setup-bun action for Build Test Bun (fixes core dump) - Bun crashes when installed inside chroot (restricted /proc) - Install on host via oven-sh/setup-bun@v2, available in chroot via PATH All smoke/build-test .md files include actions/checkout step for full repo checkout (needed by postprocess local build). Fixes #529 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
c2fc697 to
3939d46
Compare
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
Smoke Test Results: Claude EngineLast 2 Merged PRs:
Test Results:
Overall Status: PASS ✅
|
Reverts the following PRs which introduced unnecessary complexity: - #520: fix: enable Squid intercept mode for NAT-redirected traffic - v0.13.5 release: chore(release): bump version to 0.13.5 - #524: fix: remove HTTP_PROXY/HTTPS_PROXY env vars from agent container - #526: chore: recompile workflow lock files for AWF v0.13.5 - #527: fix: recompile lock files with release action mode - #522: fix: mount /etc/hosts in chroot and fix HTTP blocking test - #530: fix: restore HTTPS_PROXY, fix chroot hosts/permissions, fix Bun crash - v0.13.6 release: chore(release): bump version to 0.13.6 The intercept mode (#520) was introduced to fix Codex failing with HTTP_PROXY, but the simpler fix is to just not set HTTP_PROXY for Codex. The intercept mode introduced a cascade of breakage: - HTTPS can't be transparently intercepted (needs CONNECT method) - Image version bumps required lock file recompilation - host.docker.internal traffic crashed Squid under load - Multiple PRs needed to fix each regression This reverts to the pre-#520 explicit proxy mode (HTTP_PROXY/HTTPS_PROXY pointing to Squid port 3128) which worked for all engines. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Reverts the following PRs which introduced unnecessary complexity: - #520: fix: enable Squid intercept mode for NAT-redirected traffic - v0.13.5 release: chore(release): bump version to 0.13.5 - #524: fix: remove HTTP_PROXY/HTTPS_PROXY env vars from agent container - #526: chore: recompile workflow lock files for AWF v0.13.5 - #527: fix: recompile lock files with release action mode - #522: fix: mount /etc/hosts in chroot and fix HTTP blocking test - #530: fix: restore HTTPS_PROXY, fix chroot hosts/permissions, fix Bun crash - v0.13.6 release: chore(release): bump version to 0.13.6 The intercept mode (#520) was introduced to fix Codex failing with HTTP_PROXY, but the simpler fix is to just not set HTTP_PROXY for Codex. The intercept mode introduced a cascade of breakage: - HTTPS can't be transparently intercepted (needs CONNECT method) - Image version bumps required lock file recompilation - host.docker.internal traffic crashed Squid under load - Multiple PRs needed to fix each regression This reverts to the pre-#520 explicit proxy mode (HTTP_PROXY/HTTPS_PROXY pointing to Squid port 3128) which worked for all engines. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Summary
Fixes two regressions from recent agent-authored PRs that are breaking CI on main.
Fix 1: Restore HTTPS_PROXY (fixes Examples Test, Chroot Edge Cases, Chroot Package Managers)
PR #524 removed both
HTTP_PROXYandHTTPS_PROXYfrom the agent container. This was over-broad:HTTP_PROXYneeded.CONNECTmethod through Squid's forward-proxy port 3128. DNAT to the intercept port can't handle TLS.HTTPS_PROXYis required.Changes:
HTTPS_PROXYin the agent environment pointing tosquid:3128HTTPS_PROXY/https_proxyfrom theEXCLUDED_ENV_VARSset (keepHTTP_PROXY/http_proxyexcluded)Fix 2: Fix Smoke Chroot sparse checkout (fixes Smoke Chroot
tscbuild)PR #527 recompiled lock files, but the smoke-chroot workflow got compiled with a sparse checkout (
.github/.agentsonly). The agent job then runsnpm ci && npm run buildwhich needssrc/,package.json, etc.Changes:
actions/checkoutstep tosmoke-chroot.mdsource → compiler skips sparse checkoutsmoke-chroot.lock.ymlwith--action-mode release --action-tag v0.42.0Fixes #529
Test plan
🤖 Generated with Claude Code