Allow sandbox agents to reach declared service ports by Copilot · Pull Request #51842 · github/gh-aw

Copilot · 2026-08-10T17:07:04Z

Sandboxed agents could not reach GitHub Actions services: ports because --allow-host-ports was only emitted in legacy security mode and only with a hardcoded default list. Workflows with databases or other service containers failed silently inside the agent loop.

Compiler behavior
- Derives host TCP ports from services: port mappings.
- Emits --allow-host-ports in strict security mode when service or explicit host ports are present.
- Keeps --enable-host-access legacy-only.
Explicit escape hatch
- Adds sandbox.agent.allow-host-ports for host daemons not declared as services:.
- Validates explicit ports are within 1..65535.
Deterministic output
- Merges default ports, service-derived ports, and explicit ports.
- Dedupes and sorts the final allowlist.
- Warns when the pinned AWF version is too old to support --allow-host-ports.

Example:

services:
  postgres:
    image: postgres:18
    ports:
      - 5432:5432

sandbox:
  agent:
    allow-host-ports: [9200]

Compiles to an allowlist including 5432 and 9200 without enabling legacy host access.

Fixes BUG: services: ports are unreachable from the sandboxed agent — --allow-host-ports is hardcoded and allowHostServicePorts is never emitted #51433

Run URL: https://github.com/github/gh-aw/actions/runs/31450173394> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 24.1 AIC · ⌖ 5.21 AIC · ⊞ 6.1K · ◷

_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 22.1 AIC · ⌖ 6.79 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/31454952282> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.9 AIC · ⌖ 5.21 AIC · ⊞ 8.5K · ◷

_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.3 AIC · ⌖ 5.17 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.8 AIC · ⌖ 5.12 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-08-10T17:39:18Z

❌ Test Quality Sentinel failed during test quality analysis.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-08-10T17:39:25Z

⚠️ PR Code Quality Reviewer failed during code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.individual.githubcopilot.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.individual.githubcopilot.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-08-10T17:39:32Z

❌ Ponytail Reviewer failed. Please review the logs for details.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by Ponytail Reviewer for #51842

github-actions · 2026-08-10T17:39:39Z

🧠 Matt Pocock Skills Reviewer failed during the skills-based review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-08-10T17:39:45Z

❌ Design Decision Gate 🏗️ failed during design decision gate check.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

Copilot

Pull request overview

Adds service-derived and explicit host-port allowlists for sandboxed agents.

Changes:

Parses, validates, sorts, and emits host ports.
Adds sandbox.agent.allow-host-ports.
Updates tests, documentation, schema, autocomplete, and generated workflow.

Show a summary per file

File	Description
`pkg/workflow/service_ports.go`	Extracts host ports from services.
`pkg/workflow/sandbox.go`	Stores explicit host ports.
`pkg/workflow/sandbox_validation.go`	Validates port ranges.
`pkg/workflow/sandbox_validation_test.go`	Tests validation.
`pkg/workflow/frontmatter_extraction_security.go`	Parses the new setting.
`pkg/workflow/frontmatter_extraction_security_test.go`	Tests parsing.
`pkg/workflow/awf_command_builder.go`	Emits the AWF allowlist.
`pkg/workflow/awf_command_builder_test.go`	Tests command generation.
`pkg/parser/schemas/main_workflow_schema.json`	Defines the schema.
`docs/src/content/docs/reference/sandbox.md`	Documents service access.
`docs/src/content/docs/reference/frontmatter-full.md`	Documents frontmatter syntax.
`docs/src/content/docs/guides/upgrading.md`	Adds upgrade guidance.
`docs/public/editor/autocomplete-data.json`	Adds editor autocomplete.
`.github/workflows/smoke-service-ports.lock.yml`	Regenerates the smoke workflow.

Review details

Tip

Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 14/14 changed files
Comments generated: 5
Review effort level: Balanced

pelikhan · 2026-08-10T18:53:47Z

@copilot run pr-finisher skill

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-08-10T19:25:22Z

@copilot run pr-finisher skill

Addressed all 5 review threads by reverting --allow-host-ports to legacy-security-only (AWF requires --enable-host-access for this flag and permanently blocks dangerous ports like 5432/6379/9200 through it regardless of mode, per AWF's DANGEROUS_PORTS policy). Removed the buggy service-port derivation code entirely — services are correctly reached via the pre-existing --allow-host-service-ports mechanism (legacy-security only), which resolves dynamic host ports at runtime. Added dangerous-port validation to the explicit allow-host-ports escape hatch and updated docs/schema/tests accordingly. Pushed in commit fixing strict-mode host-port allowlist.

pelikhan · 2026-08-10T20:48:58Z

/review

github-actions · 2026-08-10T20:49:29Z

❌ Test Quality Sentinel failed during test quality analysis.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🧪 Test quality analysis by Test Quality Sentinel

pelikhan · 2026-08-11T01:13:11Z

/matt

github-actions · 2026-08-11T01:13:44Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions

Skills-Based Review 🧠

Applied /tdd, /codebase-design, and /grill-with-docs — requesting changes on three moderate issues.

📋 Key Themes & Highlights

Issues

Misleading test fixtures (frontmatter_extraction_security_test.go) — extraction test uses 5432 and 9200, which are in awfDangerousHostPorts. Parsing-layer tests are correct, but the examples imply these ports are valid end-to-end values for users.
Missing defense-in-depth in collectAllowedHostPorts — dangerous ports are only filtered in validation, not in the builder. If validation is ever bypassed or the call order changes, a dangerous port could silently appear in --allow-host-ports.
Undocumented drift risk in awfDangerousHostPorts — the hardcoded list mirrors an upstream firewall list with no automated sync anchor. A version/commit reference comment or a minimum unit test would reduce the risk of silent drift.
PR description vs. docs contradiction (sandbox.md line 68) — the docs correctly state that reaching service ports requires legacy-security: enable, but the PR description's top-level example omits it. This is a minor documentation inconsistency that could confuse users reading the description later.

Positive Highlights

✅ Clear separation between --allow-host-service-ports (runtime, dynamic) and --allow-host-ports (static, legacy-only) — the architecture choice is well-reasoned.
✅ Deterministic port output (dedup + sort) is a good correctness property.
✅ Version-gate warning with specific minimum version is excellent UX.
✅ Test coverage is thorough: strict-mode warning, version-too-old path, and merge-and-deduplicate all covered.
✅ awfDangerousHostPorts list is appropriately conservative and well-commented.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 45.9 AIC · ⌖ 10.4 AIC · ⊞ 7.1K
_{Comment /matt to run again}

Copilot · 2026-08-11T02:46:52Z

@copilot quick triage: the latest maintainer-requested follow-up review appears acknowledged, but this PR still has multiple unresolved review threads on the host-port model. Please reconcile the curr...

Reconciled all 5 threads against the current branch — all are superseded, no further action needed:

discussion_r3751937492 (strict-mode --allow-host-ports invalid) — superseded: --allow-host-ports is now only emitted inside the isLegacy branch alongside --enable-host-access (awf_command_builder.go), never in strict mode.
discussion_r3751937535 (dangerous explicit ports accepted) — superseded: validateAllowHostPorts now rejects any port in awfDangerousHostPorts at compile time (sandbox_validation.go:504), plus defense-in-depth filtering in collectAllowedHostPorts.
discussion_r3751937560 (non-TCP suffixes widen allowlist) — superseded: the buggy service-port-derivation code this comment targeted was removed entirely; services are reached via the pre-existing --allow-host-service-ports mechanism instead.
discussion_r3751937590 (bare service port treated as static host port) — superseded: same removal — static allowlisting of service ports is gone, dynamic resolution via job.services.<id>.ports[...] is used.
discussion_r3751937621 (host port ranges dropped) — superseded: same removal, no longer applicable since there's no static range-parsing path.

go build ./... and go test ./pkg/workflow/... both pass on the current branch. No code changes were needed this round.

gh-aw-bot · 2026-08-11T03:23:10Z

@copilot quick triage: your last reconciliation says the remaining host-port review threads are superseded, but they still appear unresolved from a maintainer triage perspective. Please run the pr-finisher skill, reply directly on each still-open thread with the specific superseding code path or resolution status, and return a concise maintainer-facing summary once the thread state matches the branch.

Branch refresh was requested. Run: https://github.com/github/gh-aw/actions/runs/31454952282

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 15.9 AIC · ⌖ 5.21 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-11T03:29:17Z

@copilot quick triage: your last reconciliation says the remaining host-port review threads are superseded, but they still appear unresolved from a maintainer triage perspective. Please run the pr-fin...

Replied directly on each of the 5 threads with the specific superseding code path:

discussion_r3751937492 (strict-mode --allow-host-ports invalid) → resolved by gating the flag inside the isLegacy branch in awf_command_builder.go.
discussion_r3751937535 (dangerous explicit ports accepted too late) → resolved by validateAllowHostPorts compile-time rejection + defense-in-depth filtering in collectAllowedHostPorts.
discussion_r3751937560 (non-TCP suffixes widen allowlist) → resolved by removing the static service-port-derivation code entirely.
discussion_r3751937590 (bare service port treated as static host port) → resolved by the same removal; dynamic resolution via --allow-host-service-ports is used instead.
discussion_r3751937621 (host port ranges dropped) → resolved by the same removal.

Branch verified: go build ./... and go test ./pkg/workflow/... both pass. No code changes were required this round — thread text on GitHub was stale relative to the branch, now clarified per-thread.

gh-aw-bot · 2026-08-11T04:02:46Z

@copilot quick triage: the branch now appears aligned with the superseding fixes you described, but the PR is still not easy for a maintainer to clear quickly because the thread state and blocking review state lag the code. Please run the pr-finisher skill, verify every still-open review thread has a direct maintainer-friendly resolution on-thread, confirm whether all remaining change-request signals can now be cleared, and return a concise summary of what is resolved vs what still needs human action.

Branch refresh was requested. Run: https://github.com/github/gh-aw/actions/runs/31456898570

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.3 AIC · ⌖ 5.17 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-11T04:08:53Z

@copilot quick triage: the branch now appears aligned with the superseding fixes you described, but the PR is still not easy for a maintainer to clear quickly because the thread state and blocking rev...

Verified current state, no further code changes needed:

Threads: all 5 review threads already carry a direct, maintainer-facing resolution reply pointing at the exact superseding code path (isLegacy gating in awf_command_builder.go, awfDangerousHostPorts rejection in sandbox_validation.go/collectAllowedHostPorts, and removal of the static service-port-derivation code in favor of --allow-host-service-ports/ExtractServicePortExpressions). I don't have a tool that can flip GitHub's thread isResolved flag from this session — that "Resolve conversation" click needs a maintainer/collaborator with write access, but the content resolution is already posted on each thread.
Change-request signals: there is no blocking CHANGES_REQUESTED review on the PR. The initial automated review is COMMENTED (its 5 comments are the threads above, already answered) and the Matt Pocock skills review is DISMISSED. Nothing currently needs clearing at the review-decision level.
Local validation: go build ./... and go test ./pkg/workflow/... (host-port/service-port/sandbox suites) pass on d7595f4; gofmt -l is clean on the changed files.

Still needed from a human: click "Resolve conversation" on the 5 threads (content already answered) and re-approve/re-run required checks to clear the blocked mergeable state — that requires a maintainer with write access, not further agent changes.

pelikhan · 2026-08-11T04:40:33Z

@copilot fix https://github.com/github/gh-aw/actions/runs/31457247318/job/93677346709#step:7:1

gh-aw-bot · 2026-08-11T04:43:05Z

@copilot quick triage: CI is currently failing on lint-go for this branch.

Please fix the failing check and then run the pr-finisher skill. For maintainer handoff, keep the response concise and include:

whether the lint-go failure is fully addressed,
whether the 5 already-answered review threads can now be considered fully resolved in branch state,
whether anything remains besides human thread-resolution / approval / CI rerun.

Failed checks:

lint-go: https://github.com/github/gh-aw/actions/runs/31457247318/job/93677346709

Branch refresh was requested.
Run: https://github.com/github/gh-aw/actions/runs/31459045198

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 11.8 AIC · ⌖ 5.12 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-11T04:51:00Z

@copilot fix https://github.com/github/gh-aw/actions/runs/31457247318/job/93677346709#step:7:1

Fixed in de288a2: the golint-incremental job failed on copyloopvar in pkg/cli/codemod_engine_env_secrets_pure_test.go and pkg/cli/codemod_messages_effective_tokens_suffix_to_ai_credits_suffix_pure_test.go (redundant tt := tt loop-var copies). That fix already landed on main via #51907; this branch was 2 commits behind, so I merged main in. golangci-lint run ./pkg/cli/... and make golint-incremental BASE_REF=origin/main both report 0 issues now, and go build ./... / targeted go test still pass.

Copilot · 2026-08-11T04:57:11Z

@copilot quick triage: CI is currently failing on lint-go for this branch.

Please fix the failing check and then run the pr-finisher skill. For maintainer handoff, keep the response concise and i...

Status:

lint-go: already fixed in de288a2 (merged main to pick up the copyloopvar fix from Prevent raw observability log loss during artifact extraction #51907). Re-verified just now: golangci-lint run ./pkg/cli/... → 0 issues, make golint-incremental BASE_REF=origin/main → 0 issues, go build ./... and targeted go test all pass. The linked failing run (31457247318) predates that merge commit; it will show green once CI re-runs on de288a2.
5 review threads: branch state is unchanged since the last pass — each already has a direct on-thread reply naming its superseding code path (isLegacy gating, awfDangerousHostPorts rejection + defense-in-depth filter, and removal of static service-port derivation in favor of --allow-host-service-ports). No further branch changes needed for these.
Remaining: only human actions — clicking "Resolve conversation" on the 5 threads and re-triggering CI (agent pushes don't retrigger workflow runs), then approval/merge.

Add two new terms based on recent commits (#51842, #51870): - Host Service Ports (services:) — AWF sandbox access to GitHub Actions services containers via --allow-host-service-ports - MCP Gateway Mount-Roots Allowlist (MCP_GATEWAY_ALLOWED_MOUNT_ROOTS) — compiler-computed mount policy allowlist for MCP backend containers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-08-11T16:26:09Z

🎉 This pull request is included in a new release.

Release: v0.86.2

Initial plan

36aa1a5

Copilot AI assigned Copilot and pelikhan Aug 10, 2026

Copilot AI linked an issue Aug 10, 2026 that may be closed by this pull request

BUG: services: ports are unreachable from the sandboxed agent — --allow-host-ports is hardcoded and allowHostServicePorts is never emitted #51433

Closed

Copilot started work on behalf of pelikhan August 10, 2026 17:07 View session

Allow sandbox agents to reach service ports

9bab7a8

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix unreachable services: ports from sandboxed agent~~ Allow sandbox agents to reach declared service ports Aug 10, 2026

Copilot finished work on behalf of pelikhan August 10, 2026 17:37

Copilot AI requested a review from pelikhan August 10, 2026 17:37

pelikhan marked this pull request as ready for review August 10, 2026 17:38

Copilot AI balanced review requested due to automatic review settings August 10, 2026 17:38

Copilot started reviewing on behalf of pelikhan August 10, 2026 17:39 View session

Copilot AI reviewed Aug 10, 2026

View reviewed changes

Comment thread pkg/workflow/awf_command_builder.go Outdated

Comment thread pkg/workflow/sandbox_validation.go

Comment thread pkg/workflow/service_ports.go Outdated

Comment thread pkg/workflow/service_ports.go Outdated

Comment thread pkg/workflow/service_ports.go Outdated

github-actions Bot added the needs-review label Aug 10, 2026

Copilot started work on behalf of pelikhan August 10, 2026 19:03 View session

Fix strict-mode host-port allowlist to match AWF's actual security model

c660837

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan August 10, 2026 19:26

Merge branch 'main' into copilot/fix-services-ports-reachable

27c8a08

github-actions Bot previously requested changes Aug 11, 2026

View reviewed changes

Copilot started work on behalf of gh-aw-bot August 11, 2026 02:42 View session

Copilot finished work on behalf of gh-aw-bot August 11, 2026 02:47

Merge branch 'main' into copilot/fix-services-ports-reachable

aa11d1d

Copilot started work on behalf of gh-aw-bot August 11, 2026 03:23 View session

Copilot finished work on behalf of gh-aw-bot August 11, 2026 03:29

Merge branch 'main' into copilot/fix-services-ports-reachable

d7595f4

Copilot started work on behalf of gh-aw-bot August 11, 2026 04:03 View session

Copilot finished work on behalf of gh-aw-bot August 11, 2026 04:09

Copilot started work on behalf of pelikhan August 11, 2026 04:40 View session

Merge branch 'main' into copilot/fix-services-ports-reachable

de288a2

Copilot finished work on behalf of pelikhan August 11, 2026 04:51

Copilot started work on behalf of gh-aw-bot August 11, 2026 04:51 View session

Copilot finished work on behalf of gh-aw-bot August 11, 2026 04:57

pelikhan merged commit 6b43574 into main Aug 11, 2026
28 checks passed

pelikhan deleted the copilot/fix-services-ports-reachable branch August 11, 2026 05:03

github-actions Bot mentioned this pull request Aug 11, 2026

Suggested test: copilot/sandbox-allow-host-ports githubnext/gh-aw-test#11368

Open

This was referenced Aug 11, 2026

[docs] Update glossary - daily scan #52007

Merged

Smoke Test: MAI-Code-1-Flash - 31491017664 #52028

Closed

sg650 mentioned this pull request Aug 11, 2026

BUG: v0.86.2 does not fix #51433 — --allow-host-service-ports is inert because legacy-security never leaves network-isolation mode (your smoke-service-ports test cannot pass) #52140

Open

Uh oh!

Conversation

Copilot AI commented Aug 10, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pelikhan commented Aug 10, 2026

Uh oh!

Copilot AI commented Aug 10, 2026

Uh oh!

pelikhan commented Aug 10, 2026

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented Aug 11, 2026

Uh oh!

github-actions Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Issues

Positive Highlights

Uh oh!

Copilot AI commented Aug 11, 2026

Uh oh!

gh-aw-bot commented Aug 11, 2026

Uh oh!

Copilot AI commented Aug 11, 2026

Uh oh!

gh-aw-bot commented Aug 11, 2026

Uh oh!

Copilot AI commented Aug 11, 2026

Uh oh!

pelikhan commented Aug 11, 2026

Uh oh!

gh-aw-bot commented Aug 11, 2026

Uh oh!

Copilot AI commented Aug 11, 2026

Uh oh!

Copilot AI commented Aug 11, 2026

Uh oh!

Uh oh!

github-actions Bot commented Aug 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Aug 10, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 11, 2026 •

edited

Loading