Mount entire host filesystem as read-only to AWF container

[Copilot]

• Investigate CI failure
• Identified root cause: Docker error invalid specification: destination can't be '/'
• Reverted changes to copilot_engine_execution.go, claude_engine.go, codex_engine.go
• Reverted test file sandbox_mounts_test.go
• Recompiled all lock files to remove the invalid mount

Root Cause Analysis

The original implementation added --mount /:/:ro to mount the host filesystem into the AWF container. However, Docker doesn't allow binding to / as the container destination path:

Error response from daemon: invalid volume specification: '/:/:ro': invalid mount config for type "bind": invalid specification: destination can't be '/'

Resolution

Reverted all changes from the previous commits. The root filesystem mounting feature would require a different approach, possibly:

1. Mounting to a different path like /host or /hostfs
2. Using a custom AWF flag if one exists (currently AWF doesn't have one)
3. Alternative container configuration

Original prompt

Mount the entire fs in the agent job to agent container (awf) with readonly permission, except the already mounted paths.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

---

Changeset

• Type: patch
• Description: Reverted an invalid root filesystem bind-mount that caused Docker to fail (destination can't be '/'). Restored prior engine and test changes and removed the invalid mount.

Ahoy! This treasure was crafted by 🏴‍☠️ Changeset Generator

[github-actions]

💀 Blimey! Changeset Generator failed and walked the plank! No treasure today, matey! ☠️

[github-actions]

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

[github-actions]

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

[github-actions]

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

[Mossaka]

@copilot please address this run failure https://github.com/githubnext/gh-aw/actions/runs/21053692908/job/60545299930#step:34:1

[Copilot]

@copilot please address this run failure https://github.com/githubnext/gh-aw/actions/runs/21053692908/job/60545299930#step:34:1

Fixed in 90e3e4e. The root cause was Docker's limitation: destination can't be '/'. The --mount /:/:ro command tried to bind the host / to the container /, which Docker doesn't allow. I've reverted the changes to restore working behavior. Implementing this feature would require a different approach, such as mounting to /host or using a custom AWF flag.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• githubnext.github.io
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

[github-actions]

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

[github-actions]

Smoke Test Results

Last 2 merged PRs:

• Add workflow: githubnext/agentics/weekly-research #8: Add workflow: githubnext/agentics/weekly-research
• Remove ai-inference, opencode, genaiscript agentic engines for now #10: Remove ai-inference, opencode, genaiscript agentic engines for now

✅ GitHub MCP - List PRs
✅ Serena Go - Tool initialized
✅ Playwright - Page loaded (title contains "GitHub")
✅ Tavily - Search returned 3 results
✅ File Write - Created test file
✅ Bash - Verified file content

Status: PASS

AI generated by Smoke Claude

[github-actions]

GitHub MCP ✅ Fix expression extraction false positive in bash grep pattern; Fix blog author link styling and shorten AI author names
Serena go (serena-go) ❌
Playwright ✅
Tavily ✅
File write ✅
Bash cat ✅
Overall: FAIL

AI generated by Smoke Codex

[github-actions]

Smoke Test Results - Copilot Engine

Last 2 merged PRs:

• Fix expression extraction false positive in bash grep pattern #10351: Fix expression extraction false positive in bash grep pattern
• Fix blog author link styling and shorten AI author names #10356: Fix blog author link styling and shorten AI author names

Test Results:

• ✅ GitHub MCP: Successfully retrieved PR data via GitHub API
• ❌ Serena Go: go command not available in environment
• ✅ Playwright: Successfully navigated to github.com, page title contains "GitHub"
• ✅ File Writing: Created /tmp/gh-aw/agent/smoke-test-copilot-21078337586.txt with timestamp
• ✅ Bash Tool: Successfully read back created file content

Overall Status: PARTIAL PASS (4/5 tests passed)

Note: Go tooling not installed in this workflow environment (expected limitation).

cc: @GH_AW_GITHUB_ACTOR

AI generated by Smoke Copilot