Motivation
Link to the gh-aw PR: github/gh-aw#54608 — Adds sandbox.agent.images frontmatter letting workflows pin digest-qualified images for AWF infrastructure roles (squid, agent, apiProxy, cliProxy, buildTools, dohProxy, enclaveScript, enclaveAgent, enclaveMcpServer, dindStaging), with compile-time validation rejecting ${{ }}/${...} expressions, unknown roles, malformed/tagless/digestless refs, and missing required roles for enabled features.
Proposed test
- Workflow file:
test-copilot-sandbox-agent-images.md
- Trigger:
workflow_dispatch
- Engine: copilot
- Safe output:
create-issue (minimal, to confirm the run still executes end-to-end with pinned images)
- Variant: standard
Minimal test prompt sketch
Compile and dispatch a workflow whose sandbox.agent.images block pins the required roles (squid, agent, apiProxy) to real, accessible digest-qualified images (e.g. mirrored copies of the default AWF images), then have the agent create an issue confirming it ran successfully inside the pinned-image sandbox.
New fixtures or secrets needed
Likely yes — real sha256-digest-pinned image references for the AWF infra roles that are guaranteed to stay resolvable (registry access, digest drift risk on AWF version bumps). Needs triage on whether we can reuse the default AWF images' current digests or need a maintained mirror. Also unclear whether the harness/runners have registry pull permissions for a third-party mirror.
Notes
No existing test exercises sandbox.agent.images. Compile-time-only negative cases (unknown role, malformed ref, missing required role) may be better suited to gh-aw's own unit tests than this E2E harness, which triggers real runs — this suggestion focuses on the happy-path runtime behavior only.
Generated by 🔍 Suggest New E2E Tests · auto · 20.2 AIC · ⌖ 4.38 AIC · ⊞ 8.8K · ◷
Motivation
Link to the gh-aw PR: github/gh-aw#54608 — Adds
sandbox.agent.imagesfrontmatter letting workflows pin digest-qualified images for AWF infrastructure roles (squid,agent,apiProxy,cliProxy,buildTools,dohProxy,enclaveScript,enclaveAgent,enclaveMcpServer,dindStaging), with compile-time validation rejecting${{ }}/${...}expressions, unknown roles, malformed/tagless/digestless refs, and missing required roles for enabled features.Proposed test
test-copilot-sandbox-agent-images.mdworkflow_dispatchcreate-issue(minimal, to confirm the run still executes end-to-end with pinned images)Minimal test prompt sketch
Compile and dispatch a workflow whose
sandbox.agent.imagesblock pins the required roles (squid,agent,apiProxy) to real, accessible digest-qualified images (e.g. mirrored copies of the default AWF images), then have the agent create an issue confirming it ran successfully inside the pinned-image sandbox.New fixtures or secrets needed
Likely yes — real
sha256-digest-pinned image references for the AWF infra roles that are guaranteed to stay resolvable (registry access, digest drift risk on AWF version bumps). Needs triage on whether we can reuse the default AWF images' current digests or need a maintained mirror. Also unclear whether the harness/runners have registry pull permissions for a third-party mirror.Notes
No existing test exercises
sandbox.agent.images. Compile-time-only negative cases (unknown role, malformed ref, missing required role) may be better suited to gh-aw's own unit tests than this E2E harness, which triggers real runs — this suggestion focuses on the happy-path runtime behavior only.