Lpcox/add difc - #4
Merged
Merged
Conversation
Implements Phase 1 (Foundation) and Phase 2 (Integration) of DIFC support: Phase 1 - Foundation: - Add DIFC label system with secrecy and integrity labels - Implement label flow semantics (secrecy subset, integrity superset) - Create evaluator for policy enforcement with detailed violation messages - Build agent registry for tracking per-agent labels - Add capabilities registry for global tag management - Create guard framework with interface and noop implementation - Implement guard registry with automatic noop fallback Phase 2 - Integration: - Integrate DIFC into UnifiedServer with 6-phase request flow - Add guard registration for all backend servers - Implement guardBackendCaller for metadata queries - Add agent ID extraction from Authorization headers - Implement label accumulation from read operations (taint tracking) - Add fine-grained collection filtering support Features: - ✅ NoopGuard ensures 100% backward compatibility - ✅ Comprehensive logging at each DIFC phase - ✅ Detailed violation errors with remediation guidance - ✅ Collection filtering for fine-grained access control - ✅ Label accumulation for taint tracking - ✅ 24 passing unit tests with full coverage Testing: - Complete test suite for DIFC label operations - Evaluator tests for read/write access control - Agent registry tests with label accumulation - Guard system tests including registry and context helpers - Collection filtering tests All tests passing. Ready for Phase 3 (custom guard implementations).
This was referenced Jan 19, 2026
This was referenced Feb 5, 2026
lpcox
added a commit
that referenced
this pull request
Feb 7, 2026
Smoke Codex workflow failing on schedule runs with 401 authentication errors from `https://mcp.tavily.com/mcp/` - token invalid/expired. Smoke Copilot experiences same failure but passes by completing remaining tests. ## Changes **Workflow Configuration:** - Remove `shared/mcp/tavily.md` import from `smoke-codex.md` and `smoke-copilot.md` - Remove Tavily web search test requirements (test #4 in codex, #6 in copilot) - Renumber subsequent test steps **Compiled Artifacts:** - Recompile lock files with `gh aw v0.42.13` - Remove `TAVILY_API_KEY` environment variable - Remove Tavily MCP server config from gateway TOML ## Result Smoke tests no longer depend on external service with unmaintained credentials. Both workflows now test core MCP gateway functionality (GitHub, Serena, Playwright, bash, file I/O) without Tavily web search. <!-- START COPILOT ORIGINAL PROMPT --> <details> <summary>Original prompt</summary> > > ---- > > *This section details on the original issue you should resolve* > > <issue_title>[agentics] Smoke Codex failed</issue_title> > <issue_description>### Workflow Failure > > **Workflow:** [Smoke Codex](#) > **Branch:** main > **Run URL:** https://github.com/github/gh-aw-mcpg/actions/runs/21779965253 > > > > ### Action Required > > Debug this workflow failure using the `agentic-workflows` agent: > > ``` > /agent agentic-workflows > ``` > > When prompted, instruct the agent to debug this workflow failure. > > > > Generated from [Smoke Codex](https://github.com/github/gh-aw-mcpg/actions/runs/21779965253) > > - [x] expires <!-- gh-aw-expires: 2026-02-14T12:22:06.859Z --> on Feb 14, 2026, 12:22 PM UTC > > <!-- gh-aw-agentic-workflow: Smoke Codex, run: https://github.com/github/gh-aw-mcpg/actions/runs/21779965253 --></issue_description> > > ## Comments on the Issue (you are @copilot in this section) > > <comments> > </comments> > </details> > **Custom agent used: agentic-workflows** > GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing <!-- START COPILOT CODING AGENT SUFFIX --> - Fixes #803 <!-- START COPILOT CODING AGENT TIPS --> --- ✨ Let Copilot coding agent [set things up for you](https://github.com/github/gh-aw-mcpg/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot) — coding agent works faster and does higher quality work when set up for your repo.
lpcox
added a commit
that referenced
this pull request
Feb 21, 2026
The Nightly Workflow Upgrader began timing out after `gh-aw` released v0.48.2 — the `gh aw upgrade` process (download, codemods, compile all workflows) now takes ~11–15 min, exceeding the 15-minute step limit. Run history confirms the drift: | Run | Date | Duration | Result | |-----|------|----------|--------| | #3 | Feb 19 | ~5 min | ✅ (no upgrade needed) | | #4 | Feb 20 | 11m 31s | ✅ (upgrading to v0.48.x) | | #5 | Feb 21 | >15 min | ❌ timeout | ## Changes - **`nightly-workflow-compiler.md`** — increase `timeout-minutes` from `15` to `25` (source of truth) - **`nightly-workflow-compiler.lock.yml`** — mirror the same change on the "Execute GitHub Copilot CLI" step so the running workflow actually picks it up without waiting for recompilation <!-- START COPILOT ORIGINAL PROMPT --> <details> <summary>Original prompt</summary> > > ---- > > *This section details on the original issue you should resolve* > > <issue_title>[agentics] Nightly Workflow Upgrader failed</issue_title> > <issue_description>### Workflow Failure > > **Workflow:** [Nightly Workflow Upgrader](#) > **Branch:** main > **Run URL:** https://github.com/github/gh-aw-mcpg/actions/runs/22250628311 > > > > ### Action Required > > **Option 1: Assign this issue to agent using agentic-workflows** > > Assign this issue to the `agentic-workflows` agent to automatically debug and fix the workflow failure. > > **Option 2: Manually invoke the agent** > > Debug this workflow failure using the `agentic-workflows` agent: > > ``` > /agent agentic-workflows debug the agentic workflow nightly-workflow-compiler failure in https://github.com/github/gh-aw-mcpg/actions/runs/22250628311 > ``` > > > > Generated from [Nightly Workflow Upgrader](https://github.com/github/gh-aw-mcpg/actions/runs/22250628311) > > - [x] expires <!-- gh-aw-expires: 2026-02-28T05:06:56.189Z --> on Feb 28, 2026, 5:06 AM UTC > > <!-- gh-aw-agentic-workflow: Nightly Workflow Upgrader, run: https://github.com/github/gh-aw-mcpg/actions/runs/22250628311 --></issue_description> > > ## Comments on the Issue (you are @copilot in this section) > > <comments> > </comments> > </details> > **Custom agent used: agentic-workflows** > GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing <!-- START COPILOT CODING AGENT SUFFIX --> - Fixes #1225 <!-- START COPILOT CODING AGENT TIPS --> --- 💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips](https://gh.io/copilot-coding-agent-tips) in the docs.
This was referenced Mar 3, 2026
This was referenced Mar 23, 2026
4 tasks
This was referenced Apr 9, 2026
This was referenced Apr 21, 2026
5 tasks
4 tasks
This was referenced May 4, 2026
6 tasks
This was referenced Jun 1, 2026
4 tasks
6 tasks
This was referenced Jul 6, 2026
6 tasks
Copilot AI
added a commit
that referenced
this pull request
Jul 25, 2026
- README.md: clarify `--otlp-sample-rate` has no env-var fallback (#1) - README.md: state CLI enforces --config or --config-stdin via MarkFlagsOneRequired (#3) - README.md: improve schema-required fields phrasing to be more precise (#4) - CONTRIBUTING.md: change 'Go 1.26.4 or later' to 'Go 1.26.4' (#5) - CONTRIBUTING.md: qualify container port-mapping validation as conditional (#2) - CONTRIBUTING.md: update JSON stdin example to include required gateway fields (#6) Closes #10028
lpcox
added a commit
that referenced
this pull request
Sep 16, 2026
…#13288) # Test Coverage Improvement: validateGatewayConfigWithAgentRequirement ## Function Analyzed - **Package**: `internal/config` - **Function**: `validateGatewayConfigWithAgentRequirement` (`validation_gateway.go:27`) - **Previous Coverage**: 90.0% - **New Coverage**: 100.0% - **Complexity**: High (cyclomatic complexity 40 via `gocyclo`) ## Why This Function? This function centralizes gateway/agent-selection validation for both TOML and stdin-JSON configs and is one of the highest-complexity functions in the codebase (tied for #4 by `gocyclo`), while still missing coverage on five distinct branches: the `agentId`-set-but-empty check, the `apiKey`-set-but-empty check, the exactly-one-agent-selection requirement, the `agentId` + `agentIds` combination rejection, and the `containerRuntimeCommand` blank-value error propagation. Other higher-ranked complex functions in the codebase were already fully tested in prior runs (`cmd.run`, `cmd.runProxy`, `config.LoadFromFile`, etc.), making this the best remaining target. ## Tests Added - ✅ `agentId` explicitly set to empty/whitespace rejected - ✅ `apiKey` (legacy alias) explicitly set to empty/whitespace rejected - ✅ Missing agent selection entirely rejected via `validateGatewayConfig` (`requireAgentSelection=true`) - ✅ Same missing-selection input accepted via `validateGatewayConfigForPatterns` (`requireAgentSelection=false`), proving the flag actually gates the check - ✅ `agentId` combined with `agentIds` rejected - ✅ Whitespace-only `containerRuntimeCommand` error path exercised through the full validation function ## Coverage Report ``` Before: 90.0% coverage (validateGatewayConfigWithAgentRequirement) After: 100.0% coverage Improvement: +10.0% Package internal/config: 97.4% overall ``` ## Test Execution All tests pass: ``` === RUN TestValidateGatewayConfig_AgentIDSetButEmpty --- PASS: TestValidateGatewayConfig_AgentIDSetButEmpty (0.00s) === RUN TestValidateGatewayConfig_LegacyAPIKeySetButEmpty --- PASS: TestValidateGatewayConfig_LegacyAPIKeySetButEmpty (0.00s) === RUN TestValidateGatewayConfig_RequiresExactlyOneAgentSelection --- PASS: TestValidateGatewayConfig_RequiresExactlyOneAgentSelection (0.00s) === RUN TestValidateGatewayConfigForPatterns_AllowsMissingAgentSelection --- PASS: TestValidateGatewayConfigForPatterns_AllowsMissingAgentSelection (0.00s) === RUN TestValidateGatewayConfig_RejectsAgentIDCombinedWithAgentIDs --- PASS: TestValidateGatewayConfig_RejectsAgentIDCombinedWithAgentIDs (0.00s) === RUN TestValidateGatewayConfig_ContainerRuntimeCommandWhitespaceOnly --- PASS: TestValidateGatewayConfig_ContainerRuntimeCommandWhitespaceOnly (0.00s) PASS ok github.com/github/gh-aw-mcpg/internal/config 1.958s ``` `make agent-finished`: Go format/build/lint(golangci-lint not installed in sandbox, skipped)/unit/integration all passed. The Rust guard test step failed only due to a pre-existing sandbox network restriction blocking access to `crates.io` — unrelated to this change. --- *Generated by Test Coverage Improver* *Next run will target the next most complex under-tested function* > [!WARNING] > <details> > <summary>Firewall blocked 6 domains</summary> > > The following domains were blocked by the firewall during workflow execution: > > - `github.com/ghapi` > - `example.com` > - `index.crates.io` > - `nonexistent.local` > - `slow.example.com` > - `thishostdoesnotexist12345.com` > > [!TIP] > `github.com/ghapi` is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding `github.com/ghapi` to `network.allowed`, use `tools.github.mode: gh-proxy` for direct pre-authenticated GitHub CLI access without requiring network access to `github.com/ghapi`: > > ```yaml > tools: > github: > mode: gh-proxy > ``` > > See [GitHub Tools](https://github.github.com/gh-aw/reference/github-tools/) for more information on `gh-proxy` mode. > > To allow these domains, add them to the `network.allowed` list in your workflow frontmatter: > > ```yaml > network: > allowed: > - defaults > - "github.com/ghapi" > - "example.com" > - "index.crates.io" > - "nonexistent.local" > - "slow.example.com" > - "thishostdoesnotexist12345.com" > ``` > > See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information. > > </details> > Generated by [Test Coverage Improver](https://github.com/github/gh-aw-mcpg/actions/runs/35122362500) · copilot · auto · 162.4 AIC · ⊞ 10.4K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-mcpg+%22gh-aw-workflow-id%3A+test-coverage-improver%22&type=pullrequests) <!-- gh-aw-agentic-workflow: Test Coverage Improver, engine: copilot, model: auto, id: 35122362500, workflow_id: test-coverage-improver, run: https://github.com/github/gh-aw-mcpg/actions/runs/35122362500 --> <!-- gh-aw-workflow-id: test-coverage-improver --> <!-- gh-aw-workflow-call-id: github/gh-aw-mcpg/test-coverage-improver -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added preliminary scaffolding for DIFC support.