fix: propagate config fields to all layers - #7694
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Documents the previously omitted CLI mapping for filesystem.allowWrite.
Changes:
- Adds the config-only field to the §5 mapping table.
- Links its write-boundary behavior to §4.1.
Show a summary per file
| File | Description |
|---|---|
docs/awf-config-spec.md |
Documents filesystem.allowWrite[] and its lack of a CLI equivalent. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Balanced
|
✅ Copilot review passed with no inline comments. @github-actions[bot] Add the |
|
✅ Smoke Claude passed
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 3 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "msfeed2.pkgs.visualstudio.com"
- "msfeed25.pkgs.visualstudio.com"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
✅ Build Test Suite completed successfully!
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
🚀 Security Guard has started processing this pull request |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Contribution Check completed successfully! No contribution-guideline issues found in PR #7694. The change adds the missing docs/spec row for an existing config field, and the provided context shows tests were already run for the related config mapping/schema coverage. No additional comment was needed.
|
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
github-actions
Bot
added
the
smoke-copilot-network-isolation
|
EGRESS_RESULT allow=pass deny=pass
Overall: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Smoke Test: Claude Engine Validation
Overall result: PASS
|
|
Smoke Test: Docker Sbx —
Overall: PASS
|
|
Smoke Test: Copilot Engine —
Overall: PASS
|
|
Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY).
|
Smoke Test: Services Connectivity
Overall: FAIL —
|
📡 OTel Tracing Smoke Test Results
Overall: All scenarios pass.
|
|
PR titles:
Warning Firewall blocked 3 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "msfeed2.pkgs.visualstudio.com"
- "msfeed25.pkgs.visualstudio.com"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
Upgrade gh-aw workflows to latest pre-release; fix: preserve agent startup with restricted tmp
|
Chroot Version Comparison
Overall: FAILED — Node.js version mismatch between host and chroot environments.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Note: Java (
|
|
Make digest image validation internals private
|
Config Consistency Audit — Gaps Fixed
Audited merged PRs in the last 7 days that touched AWF configuration (#7669, #7634, #7601, #7635, #7620, #7576) for consistency across JSON Schema, spec CLI mapping table, TypeScript types, and env-var wiring.
filesystem.allowWritesrc/awf-config-schema.json,docs/awf-config.schema.json,src/config-file.ts,src/types/volume-options.ts(asfilesystemAllowWrite), and enforced insrc/filesystem-policy.ts— but missing its row in the §5 CLI Mapping table ofdocs/awf-config-spec.mdfilesystem.allowWrite[]row to §5, documented as config-only (no CLI flag), matching its actual implementationVerified consistent (no action needed)
src/awf-config-schema.jsonanddocs/awf-config.schema.jsonare byte-identical (diffclean).apiProxy.targets.openai.baseUrlEnv(feat: support secret-backed OpenAI-compatible targets #7576) is fully wired: schema, spec §5 row,src/config-file.ts,src/config-mapper.ts, andsrc/openai-base-url-env.ts.container.imagesdigest-pinned manifest (Support compiler-authorized digest-pinned container image manifests #7601) has a spec §5 row and matching schema/type coverage.Verification checklist
npx jest src/config-file-mapping.test.ts src/schema.test.ts— 109 tests passeddiff src/awf-config-schema.json docs/awf-config.schema.json— identicaltsc --noEmit(docs-only change; not expected to affect compilation, but recommend running in CI)