[test-improver] Improve tests for guard package (ConfigureGlobalCompilationCache) by github-actions[bot] · Pull Request #11415 · github/gh-aw-mcpg

github-actions · 2026-08-17T23:56:40Z

File analyzed

internal/guard/wasm_test.go (tests for internal/guard/wasm_lifecycle.go)

Improvements made

Added a subtest to TestWasmGuardCompilationCache covering the early-return branch of ConfigureGlobalCompilationCache where newCompilationCache fails during creation (e.g., the cache directory argument points at a regular file instead of a directory). This verifies that:

The function returns an error immediately.
The existing global compilation cache is left untouched (not replaced).
The previous cache's Close is not invoked when the new cache creation fails, since the function must fail fast before ever touching the old cache.

This exercises a previously-uncovered branch (wasm_lifecycle.go:119-121) where err != nil from newCompilationCache(dir) causes an early return.

Coverage before/after

ConfigureGlobalCompilationCache: 90.5% → 95.2%
Package (internal/guard) total: 95.8% → 95.9%

Test output

=== RUN   TestWasmGuardCompilationCache
=== RUN   TestWasmGuardCompilationCache/global_compilation_cache_is_not_nil
=== RUN   TestWasmGuardCompilationCache/global_cache_can_be_initialized_when_nil
=== RUN   TestWasmGuardCompilationCache/custom_cache_is_used_when_provided_via_options
=== RUN   TestWasmGuardCompilationCache/global_cache_is_used_when_options_cache_is_nil
=== RUN   TestWasmGuardCompilationCache/global_cache_can_be_reconfigured_to_a_disk-backed_directory
=== RUN   TestWasmGuardCompilationCache/global_cache_remains_unchanged_when_closing_previous_cache_fails
=== RUN   TestWasmGuardCompilationCache/returns_error_immediately_when_new_cache_creation_fails
=== RUN   TestWasmGuardCompilationCache/cache_is_disabled_when_DisableCompilationCache_is_true
=== RUN   TestWasmGuardCompilationCache/close_global_compilation_cache_nils_the_shared_cache_and_becomes_idempotent
=== RUN   TestWasmGuardCompilationCache/close_global_compilation_cache_keeps_nil_state_on_close_error
--- PASS: TestWasmGuardCompilationCache (0.01s)
PASS
ok  	github.com/github/gh-aw-mcpg/internal/guard	0.017s

Also verified: go test -count=3 ./internal/guard/ (stable, no flakes), go vet ./internal/guard/ (clean), gofmt -l internal/guard/wasm_test.go (no issues).

No production code was changed; only the test file was modified.

Generated by Test Improver · auto · 109.8 AIC · ⊞ 8.4K · ◷

…CompilationCache Adds a subtest exercising the branch where newCompilationCache fails during creation (e.g. dir points at a regular file), ensuring the function returns immediately without touching or closing the existing global cache. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds coverage for failed global WASM compilation-cache creation while verifying the existing cache remains untouched.

Changes:

Adds a regular-file-path failure scenario.
Verifies fail-fast behavior and cache preservation.

Show a summary per file

File	Description
`internal/guard/wasm_test.go`	Tests cache-creation failure handling.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 1/1 changed files
Comments generated: 0
Review effort level: Balanced

github-actions · 2026-08-18T04:58:26Z

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	content returned	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	⚠️
C	CLI	list_issues (github CLI bridge)	data returned	ALLOWED	✅
C	CLI	get_file_contents (github CLI bridge)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tools absent from the MCP catalog (backend launched with GITHUB_READ_ONLY=1). Every write attempt returned Error [-32602]: unknown tool. This confirms gh-aw's defense-in-depth guarantee but does not independently confirm gateway-level DIFC/guard enforcement — that layer was never reached since the tools are absent pre-gateway. Gateway enforcement is covered by internal/guard and internal/difc unit tests.

⚠️ Parts D/E: gh is unauthenticated (GH_TOKEN not set in this environment). All REST and GraphQL write attempts fail with "set the GH_TOKEN environment variable" — not a gateway or permission refusal. The token-scope boundary cannot be validated in this run.

No writes leaked. No FAIL conditions detected.

References: §32082549694

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

github-actions · 2026-08-18T04:58:56Z

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned ✓	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned ✓	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Methodology gaps (not failures):

Part B: The GitHub MCP backend runs with GITHUB_READ_ONLY=1 (gh-aw unconditionally sets this), so only 23 read-only tools are registered. All write tool calls returned Error [-32602]: unknown tool — this confirms the backend-config defense but does not independently exercise mcpg's DIFC/guard enforcement layer, since write tools never reach a write-capable backend. Recorded as INCONCLUSIVE per spec.
Part D/E: gh CLI is not authenticated (GH_TOKEN not set in this workflow). All REST and GraphQL write attempts returned authentication errors — not gateway refusals. No writes succeeded; the token-scope boundary could not be validated in this run.

No write leaked through in any part. Run §32082549742.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

github-actions · 2026-08-18T05:01:30Z

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_pulls/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tool absent from catalog	BLOCKED	⚠️
C	CLI	reads (list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	401 unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	401 unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Gaps (no writes leaked — but enforcement unconfirmed):

Part B: All 7 write tools absent from the MCP tool catalog. GITHUB_READ_ONLY=1 is set unconditionally by gh-aw, so write tools are never registered by the backend. This is gh-aw's own defense-in-depth, not a gateway-layer enforcement test. Gateway DIFC/guard enforcement is covered by internal/guard + internal/difc unit tests.
Parts D/E: gh is unauthenticated in this environment (GH_TOKEN invalid — HTTP 401 on all calls). Token-scope boundary cannot be validated in this run.

No writes leaked. Run: §32082549616

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

github-actions Bot added automation improvement testing labels Aug 17, 2026

lpcox marked this pull request as ready for review August 18, 2026 04:54

Copilot AI balanced review requested due to automatic review settings August 18, 2026 04:54

Copilot started reviewing on behalf of lpcox August 18, 2026 04:55 View session

Copilot AI reviewed Aug 18, 2026

View reviewed changes

github-actions Bot added the readonly-stress-pass-default label Aug 18, 2026

github-actions Bot added the readonly-stress-pass-gvisor label Aug 18, 2026

github-actions Bot mentioned this pull request Aug 18, 2026

[Repo Assist] Monthly Activity 2026-08 #11396

Open

3 tasks

lpcox merged commit 7455518 into main Aug 18, 2026
35 checks passed

lpcox deleted the test-improver/guard-wasm-lifecycle-compilation-cache-4a50c004e3d6fc25 branch August 18, 2026 14:55

This was referenced Aug 18, 2026

Smoke Test: Copilot - 32151587697 #11458

Closed

Smoke Test: Copilot - 32151768615 #11460

Closed

Navigation Menu

Uh oh!

[test-improver] Improve tests for guard package (ConfigureGlobalCompilationCache) - #11415

[test-improver] Improve tests for guard package (ConfigureGlobalCompilationCache)#11415
lpcox merged 1 commit into
mainfrom
test-improver/guard-wasm-lifecycle-compilation-cache-4a50c004e3d6fc25

github-actions Bot commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

github-actions Bot commented Aug 17, 2026

File analyzed

Improvements made

Coverage before/after

Test output

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Aug 18, 2026

🔒 mcpg Read-Only Stress — default

Uh oh!

github-actions Bot commented Aug 18, 2026

🔒 mcpg Read-Only Stress — gVisor

Uh oh!

github-actions Bot commented Aug 18, 2026

🔒 mcpg Read-Only Stress — docker-sbx

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants