Skip to content

fix: debug logging for GITHUB_PATH merge + document setup-* tool availability in chroot#1468

Merged
lpcox merged 2 commits intomainfrom
copilot/fix-chroot-path-resolution
Mar 30, 2026
Merged

fix: debug logging for GITHUB_PATH merge + document setup-* tool availability in chroot#1468
lpcox merged 2 commits intomainfrom
copilot/fix-chroot-path-resolution

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 26, 2026

readGitHubPathEntries() silently returned [] when GITHUB_PATH was unset or unreadable, making it impossible to diagnose why tools installed by setup-* actions (e.g. astral-sh/setup-uv) resolved as command not found inside the AWF chroot.

Changes

  • src/docker-manager.tsreadGitHubPathEntries(): emit debug-level log messages for the two previously silent failure paths:

    • GITHUB_PATH env var not set (includes a note that sudo PATH reset may be the cause)
    • GITHUB_PATH file path set but unreadable (logs the attempted path)

    With --log-level debug you now see one of:

    [DEBUG] Merged 3 path(s) from $GITHUB_PATH into AWF_HOST_PATH
    [DEBUG] GITHUB_PATH env var is not set; skipping $GITHUB_PATH file merge …
    [DEBUG] GITHUB_PATH file at '/home/runner/_work/_temp/_runner_file_commands/add_path_…' could not be read; skipping file merge
    
  • docs/environment.md — New "GitHub Actions setup-* Tool Availability" section documenting:

    • The GITHUB_PATH → AWF_HOST_PATH → chroot PATH pipeline (introduced in v0.60.0)
    • Fallback behaviour when GITHUB_PATH is absent (relies on process.env.PATH which sudo may have reset)
    • --log-level debug troubleshooting guidance with expected log output

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI changed the title [WIP] Fix chroot PATH resolution for setup-* installed tools fix: debug logging for GITHUB_PATH merge + document setup-* tool availability in chroot Mar 26, 2026
Copilot AI requested a review from lpcox March 26, 2026 22:02
@github-actions
Copy link
Copy Markdown
Contributor

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit b89d711

@github-actions
Copy link
Copy Markdown
Contributor

✅ Coverage Check Passed

Overall Coverage

Metric Base PR Delta
Lines 82.72% 82.83% 📈 +0.11%
Statements 82.38% 82.49% 📈 +0.11%
Functions 81.50% 81.50% ➡️ +0.00%
Branches 76.19% 76.25% 📈 +0.06%
📁 Per-file Coverage Changes (1 files)
File Lines (Before → After) Statements (Before → After)
src/docker-manager.ts 86.0% → 86.5% (+0.46%) 85.5% → 85.9% (+0.45%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

@github-actions
Copy link
Copy Markdown
Contributor

🔮 Oracle Smoke Ledger
PR titles reviewed: "rename awf-issue-auditor → firewall-issue-dispatcher and prefix created issues with [awf]"; "feat: add --env-file support for injecting env vars from a file"
GitHub MCP review (last 2 merged PRs): ✅
safeinputs-gh PR query (2 PRs): ❌ (tool unavailable in runtime)
Playwright github.com title contains "GitHub": ✅
Tavily search "GitHub Agentic Workflows Firewall": ❌ (tool unavailable in runtime)
File write + bash cat verification: ✅
Discussion query + mystical discussion comment: ❌ (required discussion query/comment tool path unavailable)
Build (npm ci && npm run build): ✅
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex

Warning

⚠️ Firewall blocked 5 domains

The following domains were blocked by the firewall during workflow execution:

  • ab.chatgpt.com
  • api.github.com
  • chatgpt.com
  • github.com
  • registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "api.github.com"
    - "chatgpt.com"
    - "github.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

@lpcox lpcox marked this pull request as ready for review March 30, 2026 02:41
@lpcox lpcox requested a review from Mossaka as a code owner March 30, 2026 02:42
Copilot AI review requested due to automatic review settings March 30, 2026 02:42
@lpcox lpcox merged commit 8fcfbb8 into main Mar 30, 2026
62 checks passed
@lpcox lpcox deleted the copilot/fix-chroot-path-resolution branch March 30, 2026 02:42
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds diagnosability and documentation around how AWF makes GitHub Actions setup-* installed tools available inside the chroot by merging $GITHUB_PATH into AWF_HOST_PATH.

Changes:

  • Add debug-level logs when $GITHUB_PATH is unset or unreadable in readGitHubPathEntries().
  • Document the $GITHUB_PATHAWF_HOST_PATH → chroot PATH pipeline and troubleshooting steps in docs/environment.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
src/docker-manager.ts Adds debug logs for previously silent $GITHUB_PATH read/merge failure paths.
docs/environment.md Documents setup-* tool availability inside chroot and adds debug troubleshooting guidance.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

2. AWF reads this file at startup and merges its entries (prepended, higher priority) into `AWF_HOST_PATH`.
3. The chroot entrypoint exports `AWF_HOST_PATH` as `PATH` inside the chroot, so tools like `uv`, `node`, `python3`, `ruby`, etc. resolve correctly.

This behavior was introduced in **awf v0.60.0** and is active automatically — no extra flags are required.
Copy link

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doc claims the behavior was introduced in awf v0.60.0, but the repo’s current package version is 0.23.1 (package.json). Unless there’s a separate versioning scheme for the released CLI, this looks incorrect/misleading—suggest removing the specific version or updating it to the correct AWF release version that introduced the feature.

Suggested change
This behavior was introduced in **awf v0.60.0** and is active automatically — no extra flags are required.
This behavior is active automatically — no extra flags are required.

Copilot uses AI. Check for mistakes.
Comment on lines +121 to +133
**Troubleshooting:** Run AWF with `--log-level debug` to see whether `GITHUB_PATH` is set and how many entries were merged:

```
[DEBUG] Merged 3 path(s) from $GITHUB_PATH into AWF_HOST_PATH
```

If you see instead:

```
[DEBUG] GITHUB_PATH env var is not set; skipping $GITHUB_PATH file merge …
```

the runner did not set `GITHUB_PATH`, and the tool's bin directory must already be in `$PATH` at AWF launch time.
Copy link

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The troubleshooting snippet’s debug line (GITHUB_PATH env var is not set; skipping $GITHUB_PATH file merge …) doesn’t match the actual log message emitted in readGitHubPathEntries() (it includes the parenthetical sudo/PATH note and no ellipsis). To avoid confusing users, update the docs to match the exact emitted message(s) (including the unreadable-file case).

Copilot uses AI. Check for mistakes.
Comment on lines 176 to +178
} catch {
// File doesn't exist or isn't readable — expected outside GitHub Actions
logger.debug(`GITHUB_PATH file at '${githubPathFile}' could not be read; skipping file merge`);
Copy link

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the unreadable-file path, the catch block discards the underlying error (e.g., ENOENT vs EACCES). Since the goal here is diagnosability, consider capturing the error (catch (error)) and including it in the debug log (as a second arg) so users can tell why the file couldn't be read.

Suggested change
} catch {
// File doesn't exist or isn't readable — expected outside GitHub Actions
logger.debug(`GITHUB_PATH file at '${githubPathFile}' could not be read; skipping file merge`);
} catch (error) {
// File doesn't exist or isn't readable — expected outside GitHub Actions
logger.debug(`GITHUB_PATH file at '${githubPathFile}' could not be read; skipping file merge`, error);

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

3 participants