Cover private digest image validation internals - #7707
Conversation
There was a problem hiding this comment.
Pull request overview
Adds regression coverage ensuring digest-pinned image validation remains internal to image-resolver.
Changes:
- Verifies the validation pattern and helper are not publicly exported.
Show a summary per file
| File | Description |
|---|---|
src/image-resolver.test.ts |
Adds private API guardrail assertions. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Balanced
|
@copilot address review feedback |
The referenced review contains no actionable feedback (0 comments generated), so there are no code changes to make. Please provide the specific feedback you want addressed if further changes are needed. |
|
✅ Copilot review passed with no inline comments. @copilot Add the |
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
✅ Build Test Suite completed successfully!
|
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 3 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "msfeed2.pkgs.visualstudio.com"
- "msfeed25.pkgs.visualstudio.com"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
✅ Smoke Claude passed
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤
|
|
✅ Contribution Check completed successfully! Contribution review complete for PR #7707: no actionable CONTRIBUTING.md issues found. The change adds regression coverage in an existing test file, references a related issue, and does not require documentation or file-organization changes.
|
|
🚀 Security Guard has started processing this pull request |
|
EGRESS_RESULT allow=pass deny=pass
Overall: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
Smoke Test: Copilot BYOK (Direct Mode) ✅ PASS ✅ GitHub MCP connectivity Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY)
|
|
Service connectivity smoke test: FAIL
|
|
Smoke Test: Copilot Engine —
Overall: PASS
|
Smoke Test: Claude Engine Validation
Overall result: PASS
|
|
Cover private digest image validation internals – ✅ MCP | ✅ GitHub.com | ✅ I/O | ✅ BYOK Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (o4-mini-aw) Overall: PASS
|
Chroot Version Comparison
Result: Not all versions matched (Node.js version mismatch), so the
|
|
Docker Sbx Smoke Test
Overall: PASS cc
|
Smoke Test: API Proxy OpenTelemetry Tracing
Overall: ✅ Pass — all implemented scenarios succeeded; scenario 5 is expected-pending absent real proxied API traffic.
|
|
Reviewed merged PRs:
Queried PRs:
GitHub reads ✅ Warning Firewall blocked 3 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "msfeed2.pkgs.visualstudio.com"
- "msfeed25.pkgs.visualstudio.com"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
Cover private digest image validation internals GitHub MCP Testing: ❌
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Notes: Maven required a writable
|
Export audit flagged
DIGEST_PINNED_IMAGE_PATTERNas an unused public API inimage-resolver, where digest-pinned image validation is security-sensitive and should not drift into an external contract.Public API guardrail
Scope
image-resolver