refactor(agent-service): extract resolveAgentImageConfig from buildAgentService by Copilot · Pull Request #5129 · github/gh-aw-firewall

Copilot · 2026-06-16T18:41:25Z

buildAgentService (167 lines) mixed three concerns; the image-selection branch (~46 lines) was particularly opaque — a three-way conditional that constructs different build: vs image: objects depending on GHCR availability, preset type, and --build-local.

Changes

src/services/agent-service.ts — extracted resolveAgentImageConfig(config, imageConfig) as a standalone exported function:
- Handles the three branches: GHCR preset pull → { image }, local/custom build → { build: { context, dockerfile, args } }, passthrough → { image: agentImage }
- buildAgentService delegates via Object.assign, reducing it from 167 → ~120 lines
- Follows the existing testHelpers export pattern (@internal) so the function can be unit-tested directly
src/services/agent-service.test.ts — 6 new unit tests for resolveAgentImageConfig covering all branches (default GHCR, act GHCR, default --build-local, act --build-local, custom image build, and passthrough)

// Before: embedded in buildAgentService, no direct test path
// After: independently testable
import { testHelpers } from './agent-service';
const { resolveAgentImageConfig } = testHelpers;

const result = resolveAgentImageConfig({ agentImage: 'act', buildLocal: false }, imageConfig);
// → { image: 'ghcr.io/github/gh-aw-firewall/agent-act:latest' }

Extract image-selection logic from buildAgentService into a standalone resolveAgentImageConfig function (Sub-concern C, ~46 lines). - Isolates the three-way branch (GHCR preset / local build / passthrough) making image-provenance logic straightforward to audit - Reduces buildAgentService from 167 to ~120 lines - Exports resolveAgentImageConfig and testHelpers shim for direct unit testing without constructing a full service object - Adds 6 focused unit tests covering all three branches Closes #5118

github-actions · 2026-06-16T19:57:20Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	97.27%	97.34%	📈 +0.07%
Statements	97.15%	97.21%	📈 +0.06%
Functions	98.81%	98.82%	➡️ +0.01%
Branches	91.95%	92.02%	📈 +0.07%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/workdir-setup.ts`	92.6% → 94.4% (+1.85%)	92.6% → 94.4% (+1.85%)
`src/services/agent-service.ts`	97.7% → 100.0% (+2.33%)	97.8% → 100.0% (+2.23%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Refactors the agent Docker Compose service builder by extracting the agent image/build selection logic into a dedicated helper, making the selection branches clearer and directly unit-testable.

Changes:

Extracted image/build resolution into resolveAgentImageConfig(config, imageConfig) and simplified buildAgentService via Object.assign(...).
Added unit tests covering GHCR preset selection, --build-local build config, custom base image builds, and passthrough behavior.

Show a summary per file

File	Description
src/services/agent-service.ts	Extracts agent image/build selection into `resolveAgentImageConfig` and wires it into `buildAgentService`.
src/services/agent-service.test.ts	Adds a focused test suite for `resolveAgentImageConfig` branch coverage.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 2

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-06-16T21:07:38Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

lpcox · 2026-06-16T21:08:25Z

@copilot fix this failing ci check https://github.com/github/gh-aw-firewall/actions/runs/27648235992/job/81765494555?pr=5129

Copilot · 2026-06-16T21:15:13Z

@copilot fix this failing ci check https://github.com/github/gh-aw-firewall/actions/runs/27648235992/job/81765494555?pr=5129

Fixed in 6c3b94a. I investigated the failing Lint run and addressed the CI blockers by fixing the syntax issue in src/services/agent-service.ts and moving the new test imports in src/services/agent-service.test.ts to the top-level import section. I also re-ran lint/build/tests locally and they pass.

github-actions · 2026-06-16T23:57:09Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

github-actions · 2026-06-16T23:57:11Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

github-actions · 2026-06-16T23:57:12Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-06-16T23:57:22Z

❌ Contribution Check failed. Please review the logs for details.

github-actions · 2026-06-16T23:57:27Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-06-16T23:57:32Z

✅ Smoke Gemini completed. All facets verified. 💎

Smoke test completed with FAIL status. Comment added to PR #5129.

github-actions · 2026-06-16T23:57:40Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-06-16T23:57:43Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-06-16T23:57:48Z

✅ Build Test Suite completed successfully!

github-actions · 2026-06-16T23:58:02Z

❌ Smoke Claude failed

github-actions · 2026-06-16T23:58:02Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-06-16T23:58:09Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-06-16T23:58:36Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-06-16T23:58:43Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-06-17T00:01:12Z

chore(deps): Bump @opentelemetry/core from 1.30.1 to 2.8.0 in /containers/api-proxy in the npm_and_yarn group across 1 directory ✅
GitHub.com Connectivity ✅
File I/O round-trip ✅
BYOK inference path ✅
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS
cc @lpcox @Copilot

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-06-17T00:01:24Z

Smoke Test Results — Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP connectivity	❌ (template unresolved)
File write/read	❌ (template unresolved)

Overall: FAIL — pre-step outputs (SMOKE_HTTP_CODE, SMOKE_FILE_PATH) were not substituted; workflow step likely failed before agent ran.

cc @lpcox @Copilot

🔑 PAT report filed by Smoke Copilot PAT

github-actions · 2026-06-17T00:01:27Z

Smoke Test: Copilot BYOK (Direct) Mode — PASS ✅

✅ MCP GitHub API: Listed merged PRs
✅ GitHub.com Connectivity: HTTP 200
✅ File Write/Read: Workspace accessible
✅ BYOK Inference: Running via api-proxy → api.githubcopilot.com

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) with real key held by sidecar.

@Copilot @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-06-17T00:01:31Z

🔬 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅ PASS
GitHub.com HTTP connectivity	❌ UNKNOWN (template var unresolved)
File write/read	❌ UNKNOWN (template var unresolved)

Overall: FAIL — pre-step template variables (SMOKE_HTTP_CODE, SMOKE_FILE_PATH, SMOKE_FILE_CONTENT) were not substituted before agent execution.

PR: refactor(agent-service): extract resolveAgentImageConfig from buildAgentService
Author: @Copilot | Assignees: @lpcox, @Copilot

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-06-17T00:01:52Z

Smoke Test: Gemini Engine Validation

GitHub MCP Testing: ❌ (Unable to list PRs)
GitHub.com Connectivity: ❌ (Status: 000 / Error 35)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

github-actions · 2026-06-17T00:02:47Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.16.0	v22.22.3	❌
Go	go1.22.12	go1.22.12	✅

Overall: ❌ Not all versions match

Python and Node.js versions differ between host and chroot. Go matches correctly.

Tested by Smoke Chroot

github-actions · 2026-06-17T00:02:54Z

✅ fix: add bare API proxy targets as https:// only to prevent over-broad allowlisting
✅ refactor: decompose prepareWorkDirectories into two focused sub-functions
✅ GitHub title check
✅ file write check
✅ build check
✅ discussion check
PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-06-17T00:03:15Z

📡 Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Status	Notes
1. Module Loading	✅	`otel.js` loads; exports `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled` + internals
2. Test Suite	✅	59/59 tests passed (2 suites: `otel.test.js`, `otel-fanout.test.js`)
3. Env Var Forwarding	⚠️	Not yet in `api-proxy-service.ts` — expected during development
4. Token Tracker Integration	✅	`onUsage` callback present in `token-tracker-http.js`
5. OTEL Diagnostics	⚠️	No span file (api-proxy not active in this run) — expected

All scenarios pass or are expected-pending. No regressions detected.

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-06-17T00:03:32Z

@Copilot @lpcox

PR: refactor(agent-service): extract resolveAgentImageConfig from buildAgentService
MCP connectivity: ✅
HTTP github.com: ✅
File write/read: ✅
BYOK inference: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall ✅ PASS

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-06-17T00:04:38Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #5129 · ◷

github-actions · 2026-06-17T00:05:21Z

Smoke Test Results

host.docker.internal resolves → 172.17.0.1 ✅
Redis PING (port 6379): ❌ TCP timeout
PostgreSQL pg_isready (port 5432): ❌ no response

Overall: FAIL — service containers are not reachable from this runner environment.

🔌 Service connectivity validated by Smoke Services

Initial plan

6a07eb8

Copilot AI assigned Copilot and lpcox Jun 16, 2026

Copilot started work on behalf of lpcox June 16, 2026 18:52 View session

Copilot AI changed the title ~~[WIP] Refactor buildAgentService for improved modularity~~ refactor(agent-service): extract resolveAgentImageConfig from buildAgentService Jun 16, 2026

Copilot finished work on behalf of lpcox June 16, 2026 18:58

Copilot AI requested a review from lpcox June 16, 2026 18:58

lpcox marked this pull request as ready for review June 16, 2026 19:55

Copilot AI review requested due to automatic review settings June 16, 2026 19:55

Copilot started reviewing on behalf of lpcox June 16, 2026 19:56 View session

Copilot AI reviewed Jun 16, 2026

View reviewed changes

Comment thread src/services/agent-service.ts Outdated

Comment thread src/services/agent-service.test.ts Outdated

lpcox and others added 2 commits June 16, 2026 14:07

Potential fix for pull request finding

37f8044

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

87c2a3c

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

lpcox added the ready-for-aw label Jun 16, 2026

Copilot started work on behalf of lpcox June 16, 2026 21:09 View session

fix(agent-service): repair syntax and import ordering

6c3b94a

Copilot finished work on behalf of lpcox June 16, 2026 21:15

lpcox added ready-for-aw and removed ready-for-aw labels Jun 16, 2026

lpcox temporarily deployed to aoai-model June 16, 2026 23:57 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jun 17, 2026

github-actions Bot added the smoke-copilot-byok label Jun 17, 2026

github-actions Bot added the smoke-codex label Jun 17, 2026

lpcox temporarily deployed to aoai-model June 17, 2026 00:03 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-entra label Jun 17, 2026

lpcox temporarily deployed to aoai-model June 17, 2026 00:03 — with GitHub Actions Inactive

github-actions Bot added the build-test label Jun 17, 2026

lpcox merged commit 8d142cd into main Jun 17, 2026
82 of 85 checks passed

lpcox deleted the copilot/refactor-build-agent-service branch June 17, 2026 00:16

Conversation

Copilot AI commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lpcox commented Jun 16, 2026

Uh oh!

Copilot AI commented Jun 16, 2026

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Smoke Test Results — Auth mode: PAT (COPILOT_GITHUB_TOKEN)

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Jun 17, 2026

Smoke Test: Gemini Engine Validation

Uh oh!

github-actions Bot commented Jun 17, 2026

Chroot Version Comparison Results

Copilot AI commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading