Harden rootless AWF temp-path setup to prevent chroot hosts EACCES in Smoke CI

[Copilot]

Smoke CI was failing before first agent turn during AWF config generation with EACCES writing .../chroot-*/hosts under /tmp/awf-*. The failure was in rootless/network-isolation runs where temp/chroot write paths could inherit non-writable ownership.

• Rootless temp-root hardening

  • create_gh_aw_tmp_dir.sh now prepares /tmp/gh-aw/awf-tmp as a runner-writable temp root, including reclaim logic for stale non-writable state.
  • Added explicit remediation-oriented warnings/errors when reclaim or write preflight fails.

• Early preflight failure (instead of mid-run fatal)

  • Added a writable probe that creates a unique chroot-like temp dir and writes a hosts file before AWF runs.
  • If this fails, setup exits with a clear actionable error (ownership + cleanup guidance), rather than failing later inside AWF writeConfigs.

• Force AWF temp resolution to known writable path

  • Script exports TMPDIR, TMP, and TEMP via GITHUB_ENV so downstream AWF execution uses /tmp/gh-aw/awf-tmp instead of unpredictable /tmp/awf-* locations.

• Focused setup-script coverage

  • Extended create_gh_aw_tmp_dir_test.sh to cover:
    • creation of /tmp/gh-aw/awf-tmp,
    • env export behavior through GITHUB_ENV,
    • success path when GITHUB_ENV is unset.

# setup-time temp root pinning for rootless AWF runs
mkdir -p /tmp/gh-aw/awf-tmp
AWF_CHROOT_PROBE_DIR="$(mktemp -d /tmp/gh-aw/awf-tmp/chroot-preflight-XXXXXX)"
printf '127.0.0.1 localhost\n' > "${AWF_CHROOT_PROBE_DIR}/hosts"

# persist for subsequent steps
echo "TMPDIR=/tmp/gh-aw/awf-tmp" >> "${GITHUB_ENV}"
echo "TMP=/tmp/gh-aw/awf-tmp"    >> "${GITHUB_ENV}"
echo "TEMP=/tmp/gh-aw/awf-tmp"   >> "${GITHUB_ENV}"

[github-actions]

🤖 PR Triage

Field	Value
Category	bug
Risk	medium
Priority	high
Score	60/100 (impact: 30, urgency: 22, quality: 8)
Action	⚡ fast_track
Batch	—

Rationale: Fixes an active Smoke CI regression ( on rootless/network-isolation runs) caused by non-writable temp/chroot paths. High urgency because it directly blocks CI. Medium risk as it modifies startup scripts. Still a draft — CI not yet triggered. Recommend expedited human review once CI passes.

Generated by 🔧 PR Triage Agent · 31.2 AIC · ⌖ 8.39 AIC · ⊞ 5.4K · ◷

[Copilot]

Pull request overview

Hardens AWF rootless temporary-path setup to avoid chroot configuration permission failures.

Changes:

• Creates and validates a dedicated writable AWF temp root.
• Exports standard temp environment variables.
• Adds setup-script coverage for creation and environment export.

Show a summary per file

File	Description
actions/setup/sh/create_gh_aw_tmp_dir.sh	Adds temp-root setup, preflight probing, and environment persistence.
actions/setup/sh/create_gh_aw_tmp_dir_test.sh	Tests temp-root creation and environment behavior.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Medium