Motivation
github/gh-aw#51842 — Adds sandbox.agent.allow-host-ports so sandboxed agents can reach GitHub Actions services: ports (previously silently blocked in strict security mode).
Proposed test
- Workflow file:
test-copilot-sandbox-allow-host-ports.md
- Trigger:
workflow_dispatch
- Engine: copilot
- Safe output:
create-issue (report success/failure of reaching the service port)
- Variant: standard
Minimal test prompt sketch
Add a services: block (e.g. a simple postgres or redis container with a mapped port) and/or sandbox.agent.allow-host-ports: [<port>]. Have the agent attempt a TCP connection to localhost:<port> (e.g. via nc -zv or a short script) and create an issue reporting success or failure, so the test asserts the sandbox permits the declared port.
New fixtures or secrets needed
None — uses a standard GitHub Actions services: container (e.g. postgres:18 or redis:alpine), no new secrets.
Notes
Not covered by test-copilot-network-isolation.md (that test is about default network isolation, not explicit service-port allowlisting). No existing open suggestion covers allow-host-ports. Open question: confirm sandbox tooling (nc/curl) is available inside the agent's sandbox image for the connectivity check, or use a language-agnostic socket check instead.
Generated by 🔍 Suggest New E2E Tests · auto · 19.6 AIC · ⌖ 2.19 AIC · ⊞ 8.3K · ◷
Motivation
github/gh-aw#51842 — Adds
sandbox.agent.allow-host-portsso sandboxed agents can reach GitHub Actionsservices:ports (previously silently blocked in strict security mode).Proposed test
test-copilot-sandbox-allow-host-ports.mdworkflow_dispatchcreate-issue(report success/failure of reaching the service port)Minimal test prompt sketch
Add a
services:block (e.g. a simplepostgresorrediscontainer with a mapped port) and/orsandbox.agent.allow-host-ports: [<port>]. Have the agent attempt a TCP connection tolocalhost:<port>(e.g. vianc -zvor a short script) and create an issue reporting success or failure, so the test asserts the sandbox permits the declared port.New fixtures or secrets needed
None — uses a standard GitHub Actions
services:container (e.g.postgres:18orredis:alpine), no new secrets.Notes
Not covered by
test-copilot-network-isolation.md(that test is about default network isolation, not explicit service-port allowlisting). No existing open suggestion coversallow-host-ports. Open question: confirm sandbox tooling (nc/curl) is available inside the agent's sandbox image for the connectivity check, or use a language-agnostic socket check instead.