From 6d433a494227f4de09948ef4e8bcb1611de830fe Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 24 Aug 2026 14:44:07 +0000 Subject: [PATCH 1/2] Initial plan From 13210189a15a39d0150edef24b619a383ea7b5fc Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 24 Aug 2026 14:46:29 +0000 Subject: [PATCH 2/2] fix: keep image defaults internal --- src/image-resolver.test.ts | 7 +++++++ src/image-resolver.ts | 6 +++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/src/image-resolver.test.ts b/src/image-resolver.test.ts index 8f92116ee..24ceb54fc 100644 --- a/src/image-resolver.test.ts +++ b/src/image-resolver.test.ts @@ -6,6 +6,7 @@ import { resolveRuntimeImage, validateCustomImageManifest, } from './image-resolver'; +import * as imageResolverExports from './image-resolver'; import { parseImageTag } from './image-tag'; import type { WrapperConfig } from './types'; import { validateAwfFileConfig } from './config-file'; @@ -26,6 +27,12 @@ describe('custom runtime image manifest', () => { resetRuntimeImageLedger(); }); + it('keeps default image constants internal to the resolver', () => { + expect(imageResolverExports).not.toHaveProperty('DEFAULT_IMAGE_REGISTRY'); + expect(imageResolverExports).not.toHaveProperty('DEFAULT_DIND_STAGING_IMAGE'); + expect(imageResolverExports).not.toHaveProperty('DEFAULT_DOH_PROXY_IMAGE'); + }); + it('resolves only the digest-pinned configured image', () => { const result = resolveRuntimeImage( config({ squid: image('squid') }), diff --git a/src/image-resolver.ts b/src/image-resolver.ts index a61f1071d..a9c309b89 100644 --- a/src/image-resolver.ts +++ b/src/image-resolver.ts @@ -33,9 +33,9 @@ const MANIFEST_KEY: Record = { 'doh-proxy': 'dohProxy', }; -export const DEFAULT_IMAGE_REGISTRY = 'ghcr.io/github/gh-aw-firewall'; -export const DEFAULT_DIND_STAGING_IMAGE = 'ghcr.io/github/gh-aw-firewall/agent:latest'; -export const DEFAULT_DOH_PROXY_IMAGE = 'cloudflare/cloudflared:latest'; +const DEFAULT_IMAGE_REGISTRY = 'ghcr.io/github/gh-aw-firewall'; +const DEFAULT_DIND_STAGING_IMAGE = 'ghcr.io/github/gh-aw-firewall/agent:latest'; +const DEFAULT_DOH_PROXY_IMAGE = 'cloudflare/cloudflared:latest'; /** * Roles whose default (non-manifest) image is not published under the AWF