Motivation
Link to the gh-aw PR: github/gh-aw#51608 — Agentic engines now get an explicit --mount /tmp/gh-aw:/tmp/gh-aw:rw in BuildAWFArgs, since containerized/VM sandbox runtimes (gVisor, docker-sbx) only surface explicitly bind-mounted paths, and the runtime tree at /tmp/gh-aw was previously only incidentally visible.
Proposed test
- Workflow file:
test-copilot-sandbox-tmp-gh-aw-rw.md
- Trigger:
workflow_dispatch
- Engine: copilot
- Safe output:
create-issue
- Variant: standard (default sandboxed mode, so the mount matters)
Minimal test prompt sketch
Ask the agent to write a small marker file to /tmp/gh-aw/agent/sandbox-mount-check.txt, read it back, and include its contents in the created issue body — this exercises read/write access to the runtime tree inside the sandbox and would regress if the explicit mount is ever dropped.
New fixtures or secrets needed
None — uses the main repo and standard create-issue safe output.
Notes
Existing test-copilot-network-isolation.md exercises sandboxed mode generally but does not assert /tmp/gh-aw read-write access specifically. No existing or open-suggestion test covers this mount explicitly.
Generated by 🔍 Suggest New E2E Tests · auto · 44.6 AIC · ⌖ 2.52 AIC · ⊞ 8.3K · ◷
Motivation
Link to the gh-aw PR: github/gh-aw#51608 — Agentic engines now get an explicit
--mount /tmp/gh-aw:/tmp/gh-aw:rwinBuildAWFArgs, since containerized/VM sandbox runtimes (gVisor, docker-sbx) only surface explicitly bind-mounted paths, and the runtime tree at/tmp/gh-awwas previously only incidentally visible.Proposed test
test-copilot-sandbox-tmp-gh-aw-rw.mdworkflow_dispatchcreate-issueMinimal test prompt sketch
Ask the agent to write a small marker file to
/tmp/gh-aw/agent/sandbox-mount-check.txt, read it back, and include its contents in the created issue body — this exercises read/write access to the runtime tree inside the sandbox and would regress if the explicit mount is ever dropped.New fixtures or secrets needed
None — uses the main repo and standard
create-issuesafe output.Notes
Existing
test-copilot-network-isolation.mdexercises sandboxed mode generally but does not assert/tmp/gh-awread-write access specifically. No existing or open-suggestion test covers this mount explicitly.