fix: log stderr from rootless permission repair and make chroot-home removal non-fatal by lpcox · Pull Request #6072 · github/gh-aw-firewall

lpcox · 2026-07-09T20:07:43Z

Summary

Fixes #6070 — rootless artifact permission repair failures cause exit code 1 even when the agent task completed successfully.

Observed in: https://github.com/github/gh-aw-mcpg/actions/runs/29042841176 (Large Payload Tester)

Problem

After the agent completes and containers are stopped, fixArtifactPermissionsForRootless() runs a docker run to chown/chmod root-owned files back to the runner user. When this fails:

No stderr was logged — only (exit 1) was visible, making diagnosis impossible
Chroot-home removal failure was fatal — the EACCES error from fs.rmSync propagated as exit code 1, failing the entire step despite the agent task having succeeded
The Post Setup Scripts step (compiled by gh-aw) successfully cleaned up the same directory via sudo — so AWF's Node.js rimrafSync attempt was redundant

Changes

`src/artifact-permissions.ts`

Capture and log stderr from the repair docker run command so failures are diagnosable

`src/artifact-preservation.ts`

Downgrade chroot-home removal failures from logger.warn to logger.debug since the post-step cleanup handles it via sudo
This prevents permission repair failures from escalating to a non-zero exit code

`src/artifact-permissions.test.ts`

Add test: stderr is included in the warning message when repair fails
Add test: no trailing colon when stderr is empty

Testing

Test Suites: 2 passed, 2 total
Tests:       17 passed, 17 total

…removal non-fatal - Capture and log stderr from the Docker-based permission repair container so failures are diagnosable (previously only exit code was logged) - Downgrade chroot-home removal failures from warn to debug since the post-step cleanup (install_copilot_cli.sh) handles it via sudo - This prevents permission repair failures from causing exit code 1 when the agent task itself completed successfully - Add tests for stderr logging behavior Closes #6070 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-07-09T20:09:59Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	99.15%	99.21%	📈 +0.06%
Statements	99.11%	99.17%	📈 +0.06%
Functions	99.45%	99.45%	➡️ +0.00%
Branches	95.77%	95.75%	📉 -0.02%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/artifact-permissions.ts`	93.8% → 97.0% (+3.21%)	93.8% → 97.0% (+3.21%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

This PR improves post-run cleanup behavior in rootless Docker scenarios by making permission-repair failures more diagnosable (logging stderr) and preventing chroot-home cleanup issues from failing an otherwise successful agent run.

Changes:

Include trimmed stderr in the warning emitted when the rootless permission-repair docker run exits non-zero.
Make chroot-home removal failures non-fatal by downgrading logging to debug and swallowing retry failures.
Add tests to validate stderr inclusion and avoid a trailing colon when stderr is empty.

Show a summary per file

File	Description
src/artifact-permissions.ts	Appends trimmed stderr to permission-repair failure warnings for better diagnostics.
src/artifact-preservation.ts	Makes chroot-home deletion failures non-fatal and lowers log severity to avoid failing successful runs.
src/artifact-permissions.test.ts	Adds regression tests for stderr formatting in permission-repair failure logs.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 3
Review effort level: Low

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-07-10T02:05:22Z

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-10T02:05:51Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

github-actions · 2026-07-10T02:05:51Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-10T02:05:52Z

✅ Smoke Gemini completed. All facets verified. 💎

github-actions · 2026-07-10T02:05:52Z

🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅

github-actions · 2026-07-10T02:05:53Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-10T02:05:53Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

github-actions · 2026-07-10T02:05:54Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-10T02:05:54Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-10T02:05:54Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-07-10T02:05:55Z

✅ Contribution Check completed successfully!

PR #6072 follows the applicable CONTRIBUTING.md guidelines: it includes focused tests for the behavior change, has a clear description referencing issue #6070, uses appropriate src/ locations, and does not require documentation updates.

github-actions · 2026-07-10T02:05:56Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-10T02:05:56Z

✅ Smoke Claude passed

github-actions · 2026-07-10T02:05:57Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-10T02:05:57Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-10T02:07:38Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	99.15%	99.21%	📈 +0.06%
Statements	99.11%	99.17%	📈 +0.06%
Functions	99.45%	99.45%	➡️ +0.00%
Branches	95.77%	95.75%	📉 -0.02%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/artifact-permissions.ts`	93.8% → 97.0% (+3.21%)	93.8% → 97.0% (+3.21%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-10T02:07:42Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	99.15%	99.21%	📈 +0.06%
Statements	99.11%	99.17%	📈 +0.06%
Functions	99.45%	99.45%	➡️ +0.00%
Branches	95.77%	95.75%	📉 -0.02%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/artifact-permissions.ts`	93.8% → 97.0% (+3.21%)	93.8% → 97.0% (+3.21%)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-10T02:09:10Z

Smoke Test: Claude Engine Validation

Overall result: ✅ PASS

Check	Result
API status	✅ PASS
GH check	✅ PASS
File status	✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6072 · 55.8 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T02:09:27Z

🔥 Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Details
1. Module Loading	✅	`otel.js` loads; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`
2. Test Suite	✅	59 tests passed, 2 suites — all green
3. Env Var Forwarding	✅	`observability-environment.ts` forwards all `OTEL_*` env vars to api-proxy
4. Token Tracker Integration	✅	`onUsage` callback exists in `token-tracker-http.js` as OTEL hook point
5. OTEL Diagnostics	✅	FileSpanExporter + ProxyAwareOtlpExporter tests pass; no errors
6. Graceful Degradation	✅	`isEnabled` + null-span no-ops confirmed in test suite

All scenarios pass. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T02:09:30Z

Smoke Test: Copilot BYOK (Direct) Mode

@lpcox

Test	Result
GitHub MCP connectivity	✅
GitHub.com connectivity	✅
File write/read	✅
BYOK inference (api-proxy → api.githubcopilot.com)	✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T02:09:31Z

🔬 Smoke Test Results

Test	Result
GitHub MCP	✅ Connected
GitHub.com HTTP	✅ 200 OK
File Write/Read	⚠️ Pre-step template vars not expanded

Overall: PASS — core connectivity verified

PR author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T02:09:36Z

Smoke Test: Copilot PAT Auth

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	⚠️ Template vars not substituted

Overall: PASS (partial — pre-step template data unavailable)

Auth mode: PAT (COPILOT_GITHUB_TOKEN) | PR author: @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T02:09:46Z

Smoke Test: Services Connectivity

Redis PING: ❌ Network unreachable
PostgreSQL pg_isready: ❌ No response
PostgreSQL SELECT 1: ❌ Network unreachable

Overall: FAIL — host.docker.internal (172.17.0.1) is unreachable. Service containers may not be running or network routing is misconfigured.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T02:10:32Z

Smoke Test: Gemini Engine Validation

GitHub MCP Testing: ❌ (Tools missing)
GitHub.com Connectivity: ❌ (Timeout)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T02:11:58Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: NOT all tests passed. Python and Node.js versions differ between host and chroot environments.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T02:12:02Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6072 · 35.1 AIC · ⊞ 6.9K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-10T02:18:17Z

fix: log stderr from rootless permission repair and make chroot-home removal non-fatal
chore: upgrade gh-aw to v0.82.7 pre-release and recompile workflows
refactor: pre-validate host port specs once in TypeScript, eliminate duplicate shell parser
GitHub query: ✅
Playwright GitHub title: ✅
File write/read: ✅
Discussion comment: ✅
Build: ❌
Overall: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

awmgmcpg
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

- Update D1: gVisor resolved in #6093; Kata Containers still open - Add B11: silent repair failure causes exit 1, fixed in #6072 - Add B11 error-string lookup entry in all three catalog files - Update Known unresolved items: narrow D1 to Kata only - Update symptom mapping and known-gaps step in both doctor files - Update CI test assertions for D1 and B11 Closes #6103

…nt repair exit-1 (#6118) * Initial plan * docs: update runner doctor catalog - D1 gVisor resolved, add B11 - Update D1: gVisor resolved in #6093; Kata Containers still open - Add B11: silent repair failure causes exit 1, fixed in #6072 - Add B11 error-string lookup entry in all three catalog files - Update Known unresolved items: narrow D1 to Kata only - Update symptom mapping and known-gaps step in both doctor files - Update CI test assertions for D1 and B11 Closes #6103 * docs: align runner-doctor B11 and D1 wording with implementation --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 9, 2026 20:07

Copilot started reviewing on behalf of lpcox July 9, 2026 20:08 View session

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Comment thread src/artifact-preservation.ts Outdated

Comment thread src/artifact-permissions.test.ts

Comment thread src/artifact-permissions.test.ts

lpcox and others added 3 commits July 9, 2026 19:05

Potential fix for pull request finding

f45923a

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

feb46c3

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Potential fix for pull request finding

c255e15

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

lpcox added the ready-for-aw label Jul 10, 2026

lpcox had a problem deploying to aoai-model July 10, 2026 02:05 — with GitHub Actions Failure

lpcox temporarily deployed to aoai-model July 10, 2026 02:09 — with GitHub Actions Inactive

github-actions Bot added the smoke-claude label Jul 10, 2026

lpcox temporarily deployed to aoai-model July 10, 2026 02:09 — with GitHub Actions Inactive

github-actions Bot mentioned this pull request Jul 10, 2026

[aw] No-Op Runs #5883

Open

github-actions Bot added smoke-copilot-byok smoke-copilot labels Jul 10, 2026

github-actions Bot added the smoke-copilot-pat label Jul 10, 2026

github-actions Bot mentioned this pull request Jul 10, 2026

[aw] Smoke Copilot BYOK AOAI (Entra) failed #6076

Closed

github-actions Bot mentioned this pull request Jul 10, 2026

[aw] Smoke Copilot BYOK AOAI (api-key) failed #6077

Closed

github-actions Bot added the build-test label Jul 10, 2026

lpcox merged commit 3078518 into main Jul 10, 2026
85 of 88 checks passed

lpcox deleted the fix/rootless-permission-repair-logging branch July 10, 2026 02:28

github-actions Bot mentioned this pull request Jul 10, 2026

🩺 Runner Doctor Update🩺 Runner Doctor update: D1 (gVisor resolved), B11 (silent repair failure → exit 1) #6103

Closed

Copilot AI mentioned this pull request Jul 11, 2026

docs: update runner doctor catalog — D1 gVisor resolved, add B11 silent repair exit-1 #6118

Merged

lpcox mentioned this pull request Jul 16, 2026

fix: add EACCES diagnostic + fallback for chroot hosts file write #6285

Merged

mavam mentioned this pull request Jul 17, 2026

Rootless artifact permission repair never runs: agent image ENTRYPOINT hijacks the repair command and adds an exact 30 s failure per directory #6334

Closed

Copilot AI mentioned this pull request Jul 18, 2026

Bypass agent ENTRYPOINT in rootless artifact permission repair #6342

Merged

Uh oh!

Conversation

lpcox commented Jul 9, 2026

Summary

Problem

Changes

src/artifact-permissions.ts

src/artifact-preservation.ts

src/artifact-permissions.test.ts

Testing

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 10, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Jul 10, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions Bot commented Jul 10, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Jul 10, 2026

🔥 Smoke Test: API Proxy OpenTelemetry Tracing

`src/artifact-permissions.ts`

`src/artifact-preservation.ts`

`src/artifact-permissions.test.ts`

github-actions Bot commented Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading

github-actions Bot commented Jul 10, 2026 •

edited

Loading