Add runner-doctor B26 artifact download failure mode by Copilot · Pull Request #7667 · github/gh-aw-firewall

Copilot · 2026-08-23T17:36:37Z

Runner Doctor needed coverage for --network-isolation artifact ZIP downloads failing when gh follows GitHub’s redirect to Azure Blob storage from inside cli-proxy.

Failure-mode catalog
- Added B26 to the shared self-hosted runner catalog.
- Documents the mcpg redirect behavior change, cli-proxy egress constraint, and AWF remediation via scoped Squid routing.
Doctor quick lookup
- Added the blob-storage error string lookup to the runner-doctor playbook.
- Added a concise B26 playbook entry for triage and recommended upgrade path.
Alignment coverage
- Added focused assertions so future catalog updates preserve the B26 row, error lookup, and key citations.

`error connecting to productionresultssa*.blob.core.windows.net`
→ B26

Fixes 🩺 Runner Doctor UpdateRunner Doctor: add B26 (network-isolation artifact ZIP download via blob storage egress, #7615/#7635) #7663

Copilot

Pull request overview

Adds B26 guidance for network-isolated artifact downloads failing on Azure Blob redirects.

Changes:

Documents B26 diagnosis and remediation.
Adds doctor quick-lookup guidance.
Adds alignment assertions.

Show a summary per file

File	Description
`.github/workflows/shared/self-hosted-failure-modes.md`	Adds B26 catalog and lookup entries.
`.github/workflows/self-hosted-runner-doctor.md`	Adds B26 triage guidance.
`scripts/ci/self-hosted-runner-doctor-workflow.test.ts`	Adds B26 documentation assertions.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 3/3 changed files
Comments generated: 3
Review effort level: Balanced

+    // B26 new failure mode (network-isolation artifact ZIP download via blob storage egress)
+    expect(shared).toContain('| B26 | In `--network-isolation` mode');
+    expect(shared).toContain('`error connecting to productionresultssa*.blob.core.windows.net`');
+    expect(shared).toContain('`http_access allow from_cli_proxy cli_proxy_artifact_storage`');
+    expect(shared).toContain('github/gh-aw#54371, github/gh-aw-firewall#7615, github/gh-aw-firewall#7635');
+    expect(shared).toContain('| `error connecting to productionresultssa*.blob.core.windows.net` from `gh run download`/artifact ZIP fetch in `--network-isolation` mode | B26');


lpcox · 2026-08-23T17:58:06Z

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-08-23T18:04:22Z

@copilot address review feedback

Addressed in 16ebfba: synchronized B26 to the portable doctor, corrected the gh-aw-mcpg citation, and expanded alignment coverage.

github-actions · 2026-08-23T19:15:19Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-08-23T19:18:13Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.75%	93.82%	📈 +0.07%
Statements	92.60%	92.70%	📈 +0.10%
Functions	92.95%	93.09%	📈 +0.14%
Branches	85.91%	86.06%	📈 +0.15%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/cloud-hypervisor/virtiofsd.ts`	76.2% → 77.7% (+1.48%)	72.5% → 74.8% (+2.33%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (1 files)

src/cloud-hypervisor/mount-tree.ts: 98.4% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-08-23T19:42:35Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-08-23T19:42:35Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-08-23T19:42:37Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-08-23T19:42:37Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-08-23T19:42:37Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-08-23T19:42:37Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #7667

github-actions · 2026-08-23T19:42:38Z

❌ Contribution Check failed. Please review the logs for details.

Generated by Contribution Check for #7667

github-actions · 2026-08-23T19:42:38Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-08-23T19:42:39Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-08-23T19:42:39Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-08-23T19:42:39Z

✅ Smoke Claude passed

Generated by Smoke Claude for #7667

github-actions · 2026-08-23T19:42:40Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-08-23T19:42:43Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

msfeed2.pkgs.visualstudio.com
msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed2.pkgs.visualstudio.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-08-23T19:42:45Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-08-23T19:45:29Z

Smoke Test: Claude Engine Validation

Check	Result
API	✅ PASS
gh CLI	✅ PASS
File	✅ PASS

Overall result: PASS

Generated by Smoke Claude for #7667 · haiku45 · 55.7 AIC · ⊞ 4.5K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-08-23T19:45:33Z

Smoke Test Results — @lpcox

✅ GitHub MCP: PR feat: support filesystem allowWrite with Cloud Hypervisor #7669 "feat: support filesystem allowWrite with Cloud Hypervisor"
✅ GitHub.com connectivity: HTTP 200
✅ File write/read test: passed

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-23T19:45:48Z

@lpcox Network isolation egress smoke test results:

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com): reachable (HTTP 200)
✅ Blocked domain (example.com): blocked (403 via proxy)

Overall status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-08-23T19:46:03Z

Smoke Test: Copilot BYOK (Direct) Mode — PASS ✅

✅ GitHub MCP connectivity
✅ HTTP 200 (github.com)
✅ File write/read ops
✅ BYOK inference via api-proxy sidecar

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) → api-proxy → api.githubcopilot.com

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-08-23T19:46:28Z

Smoke Test: Docker Sbx — PR by @Copilot (assignees: @lpcox, @Copilot)

✅ MCP: PR feat: support filesystem allowWrite with Cloud Hypervisor #7669, feat: stage host mount trees for virtiofsd exports #7661 titles matched
✅ GitHub.com connectivity: HTTP 200
✅ File write/read test passed

Overall: PASS

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-08-23T19:46:34Z

Smoke Test Results: GitHub Actions Services Connectivity

Redis PING: ❌ (DNS resolution failure)
PostgreSQL pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (DNS resolution failure)

REDIS=Could not connect to Redis at host.docker.internal:6379: Temporary failure in name resolution
PG_READY=host.docker.internal:5432 - no response
PG_QUERY=psql: error: could not translate host name "host.docker.internal" to address: Temporary failure in name resolution

Overall: FAIL — host.docker.internal could not be resolved from within the AWF sandbox.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-08-23T19:47:08Z

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.19.0	v2.97.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Node.js version mismatch between host and chroot environment.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-08-23T19:47:57Z

Recent PR titles:

feat: add Cloud Hypervisor filesystem write planner
unavailable

GitHub read smoke: ❌
safeinputs-gh pr list: ❌
Playwright github.com title: ✅
Temp file + cat: ✅
npm ci && npm run build: ✅
Discussion query/comment: ❌
Overall: FAIL

Warning

Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

msfeed2.pkgs.visualstudio.com
msfeed25.pkgs.visualstudio.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "msfeed2.pkgs.visualstudio.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-08-23T19:48:13Z

feat: support filesystem allowWrite with Cloud Hypervisor
feat: stage host mount trees for virtiofsd exports
MCP Testing: ❌
GitHub.com Connectivity: ✅
File Write/Read Test: ✅
BYOK Inference Test: ✅
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
Overall status: FAIL
By @Copilot; Assignees: @lpcox, @Copilot

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-08-23T19:48:27Z

OTel Tracing Smoke Test Results

✅ Scenario 1 (Module Loading): otel.js loads successfully, isEnabled() → true, exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled + internals.
✅ Scenario 2 (Test Suite): otel-workload-identity.test.js, otel-fanout.test.js, otel.test.js — 3 suites, 68 tests, all passed.
✅ Scenario 3 (Env Var Forwarding): GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID present in env-passthrough.ts; GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and both trace-context vars present in api-proxy-env-config.ts.
✅ Scenario 4 (Token Tracker Integration): onUsage callback present in token-tracker-http.js as the OTEL hook point.
⚠️ Scenario 5 (OTel Diagnostics): No local otel.jsonl span file found (spans were routed live to the configured Sentry OTLP endpoint rather than a local file exporter, so nothing to inspect locally). token-usage.jsonl confirms 12 proxied requests were tracked with token/credit accounting during this run — expected, not a failure.

Overall: All scenarios pass or are expected-pending. No regression detected in the OTel tracing integration.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-08-23T19:49:03Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

All clones, installs/builds, and test suites completed successfully across Bun, C++, Deno, .NET, Go, Java, Node.js, and Rust. Java required a -Dmaven.repo.local override to a writable path since ~/.m2 was root-owned in this environment (unrelated to firewall behavior); the Squid proxy config itself worked correctly for Maven traffic.

Generated by Build Test Suite for #7667 · auto · 50.7 AIC · ⊞ 12K · ◷
_{Add label ready-for-aw to run again}

Initial plan

ad5598c

Copilot AI assigned Copilot and lpcox Aug 23, 2026

Copilot started work on behalf of lpcox August 23, 2026 17:36 View session

Copilot AI linked an issue Aug 23, 2026 that may be closed by this pull request

🩺 Runner Doctor UpdateRunner Doctor: add B26 (network-isolation artifact ZIP download via blob storage egress, #7615/#7635) #7663

Closed

docs: add runner doctor B26 failure mode

8d53f4a

Copilot AI changed the title ~~[WIP] Update runner doctor to add B26 for network isolation artifact download~~ Add runner-doctor B26 artifact download failure mode Aug 23, 2026

Copilot finished work on behalf of lpcox August 23, 2026 17:40

Copilot AI requested a review from lpcox August 23, 2026 17:40

lpcox marked this pull request as ready for review August 23, 2026 17:47

Copilot AI balanced review requested due to automatic review settings August 23, 2026 17:47

Copilot started reviewing on behalf of lpcox August 23, 2026 17:47 View session

Copilot AI reviewed Aug 23, 2026

View reviewed changes

Copilot started work on behalf of lpcox August 23, 2026 17:58 View session

docs: align portable runner doctor B26

16ebfba

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot finished work on behalf of lpcox August 23, 2026 18:04

lpcox added the ready-for-aw label Aug 23, 2026

lpcox enabled auto-merge (squash) August 23, 2026 19:42

lpcox deployed to aoai-model August 23, 2026 19:42 — with GitHub Actions Active

github-actions Bot added the smoke-claude label Aug 23, 2026

github-actions Bot added the smoke-copilot label Aug 23, 2026

github-actions Bot mentioned this pull request Aug 23, 2026

[aw] Contribution Check failed #7673

Closed

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Aug 23, 2026

github-actions Bot added smoke-copilot-byok smoke-docker-sbx labels Aug 23, 2026

lpcox deployed to aoai-model August 23, 2026 19:48 — with GitHub Actions Active

github-actions Bot added the build-test label Aug 23, 2026

github-actions Bot mentioned this pull request Aug 23, 2026

[aw] Smoke Copilot BYOK AOAI (api-key) hit engine rate limit (HTTP 429) #7675

Closed

lpcox merged commit a7b9745 into main Aug 23, 2026
157 of 161 checks passed

lpcox deleted the copilot/update-runner-doctor-add-b26 branch August 23, 2026 19:55

Uh oh!

Conversation

Copilot AI commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

lpcox commented Aug 23, 2026

Uh oh!

Copilot AI commented Aug 23, 2026

Uh oh!

github-actions Bot commented Aug 23, 2026

Uh oh!

github-actions Bot commented Aug 23, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 23, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Aug 23, 2026

Uh oh!

github-actions Bot commented Aug 23, 2026

Uh oh!

github-actions Bot commented Aug 23, 2026

Uh oh!

github-actions Bot commented Aug 23, 2026

Uh oh!

github-actions Bot commented Aug 23, 2026

Uh oh!

github-actions Bot commented Aug 23, 2026

Chroot Version Comparison

Uh oh!

github-actions Bot commented Aug 23, 2026

Copilot AI commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading

github-actions Bot commented Aug 23, 2026 •

edited

Loading