Function TestFirewallArgsInCopilotEngine

pkg/workflow/firewall_args_test.go:13–421

TestFirewallArgsInCopilotEngine tests that custom firewall args are included in AWF command

(t *testing.T)

// TestFirewallArgsInCopilotEngine tests that custom firewall args are included in AWF command
func TestFirewallArgsInCopilotEngine(t *testing.T) {
	t.Run("no custom args uses only default flags", func(t *testing.T) {
		workflowData := &WorkflowData{
			Name: "test-workflow",
			EngineConfig: &EngineConfig{
				ID: "copilot",
			},
			NetworkPermissions: &NetworkPermissions{
				Firewall: &FirewallConfig{
					Enabled: true,
				},
			},
		}

		engine := NewCopilotEngine()
		steps := engine.GetExecutionSteps(workflowData, "test.log")

		stepContent := requireCopilotExecutionStep(t, steps)

		// Check that the command contains awf (AWF v0.15.0+ uses chroot mode by default)
		if !strings.Contains(stepContent, "sudo -E awf") {
			t.Error("Expected command to contain 'sudo -E awf'")
		}

		// With config file support (default AWF version), domains appear in the JSON config
		// rather than as a --allow-domains CLI flag. Verify the config JSON is written.
		if !strings.Contains(stepContent, "allowDomains") {
			t.Error("Expected command to contain 'allowDomains' in the AWF config JSON")
		}

		if !strings.Contains(stepContent, "--log-level") {
			t.Error("Expected command to contain '--log-level'")
		}

		initSnippet := `GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=""`
		dockerHostInitSnippet := `GH_AW_DOCKER_HOST=""`
		dockerHostConditionSnippet := `if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then`
		dockerHostAssignmentSnippet := `GH_AW_DOCKER_HOST="${DOCKER_HOST}"`
		dockerHostArgsRefSnippet := `${GH_AW_DOCKER_HOST:+--docker-host "$GH_AW_DOCKER_HOST"}`
		conditionSnippet := `if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then`
		flagAssignmentSnippet := `GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS="--docker-host-path-prefix ${RUNNER_TEMP}/gh-aw"`
		argsRefSnippet := `${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS}`

		dockerHostInitIdx := strings.Index(stepContent, dockerHostInitSnippet)
		dockerHostConditionIdx := strings.Index(stepContent, dockerHostConditionSnippet)
		dockerHostAssignmentIdx := strings.Index(stepContent, dockerHostAssignmentSnippet)
		dockerHostArgsRefIdx := strings.Index(stepContent, dockerHostArgsRefSnippet)
		initIdx := strings.Index(stepContent, initSnippet)
		conditionIdx := -1
		if initIdx != -1 {
			conditionOffset := strings.Index(stepContent[initIdx:], conditionSnippet)
			if conditionOffset != -1 {
				conditionIdx = initIdx + conditionOffset
			}
		}
		flagIdx := strings.Index(stepContent, flagAssignmentSnippet)
		argsRefIdx := strings.Index(stepContent, argsRefSnippet)
		if dockerHostInitIdx == -1 || dockerHostConditionIdx == -1 || dockerHostAssignmentIdx == -1 || dockerHostArgsRefIdx == -1 || dockerHostInitIdx >= dockerHostConditionIdx || dockerHostConditionIdx >= dockerHostAssignmentIdx || dockerHostAssignmentIdx >= dockerHostArgsRefIdx {