Skip to content

Commit aef6421

Browse files
MossakaMossaka
committed
first commit
0 parents  commit aef6421

59 files changed

Lines changed: 23950 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.dockerignore‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
node_modules
2+
npm-debug.log
3+
dist
4+
.git
5+
.github
6+
*.md
7+
.gitignore
8+
.env
9+
*.tgz
10+
.DS_Store

‎.gitattributes‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.github/workflows/*.lock.yml linguist-generated=true merge=ours

‎.github/workflows/dev.lock.yml‎

Lines changed: 1785 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.github/workflows/dev.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
on:
3+
workflow_dispatch:
4+
concurrency:
5+
group: dev-workflow-${{ github.ref }}
6+
cancel-in-progress: true
7+
name: Dev
8+
engine: copilot
9+
permissions:
10+
contents: read
11+
actions: read
12+
tools:
13+
github:
14+
---
15+
16+
# Test GitHub MCP Tools
17+
18+
Test each GitHub MCP tool with sensible arguments to verify they are configured properly.
19+
20+
**Goal**: Invoke each tool from the GitHub MCP server with reasonable arguments. Some tools may fail due to missing data or invalid arguments, but they should at least be callable. Fail if there are permission issues indicating the tools aren't properly configured.
21+
22+
## Instructions
23+
24+
**Discover and test all available GitHub MCP tools:**
25+
26+
1. First, explore and identify all tools available from the GitHub MCP server
27+
2. For each discovered tool, invoke it with sensible arguments based on the repository context (${{ github.repository }})
28+
3. Use appropriate parameters for each tool (e.g., repository name, issue numbers, PR numbers, etc.)
29+
30+
Example tools you should discover and test may include (but are not limited to):
31+
- Context tools: `get_me`, etc.
32+
- Repository tools: `get_file_contents`, `list_branches`, `list_commits`, `search_repositories`, etc.
33+
- Issues tools: `list_issues`, `search_issues`, `get_issue`, etc.
34+
- Pull Request tools: `list_pull_requests`, `get_pull_request`, `search_pull_requests`, etc.
35+
- Actions tools: `list_workflows`, `list_workflow_runs`, etc.
36+
- Release tools: `list_releases`, etc.
37+
- And any other tools you discover from the GitHub MCP server
38+
39+
## Expected Behavior
40+
41+
- Each tool should be invoked successfully, even if it returns empty results or errors due to data not existing
42+
- If a tool cannot be called due to **permission issues** (e.g., "tool not allowed", "permission denied", "unauthorized"), the task should **FAIL**
43+
- If a tool fails due to invalid arguments or missing data (e.g., "resource not found", "invalid parameters"), that's acceptable - continue to the next tool
44+
- Log the results of each tool invocation (success or failure reason)
45+
46+
## Summary
47+
48+
After testing all tools, provide a summary:
49+
- Total tools tested: [count]
50+
- Successfully invoked: [count]
51+
- Failed due to missing data/invalid args: [count]
52+
- Failed due to permission issues: [count] - **FAIL if > 0**
53+
54+
If any permission issues were encountered, clearly state which tools had permission problems and fail the workflow.

‎.github/workflows/scout.yml‎

Lines changed: 4938 additions & 0 deletions
Large diffs are not rendered by default.

‎.github/workflows/test-copilot-fetch.yml‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
name: Test Firewall with Copilot Fetch
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
test-copilot-fetch:
15+
runs-on: ubuntu-latest
16+
timeout-minutes: 10
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@v4
21+
22+
- name: Setup Node.js
23+
uses: actions/setup-node@v4
24+
with:
25+
node-version: '20'
26+
27+
- name: Install dependencies
28+
run: |
29+
npm install
30+
npm run build
31+
32+
- name: Make wrapper available globally with sudo
33+
run: |
34+
# Create sudo wrapper script for iptables manipulation
35+
sudo tee /usr/local/bin/awf > /dev/null <<EOF
36+
#!/bin/bash
37+
exec $(which node) $GITHUB_WORKSPACE/dist/cli.js "\$@"
38+
EOF
39+
sudo chmod +x /usr/local/bin/awf
40+
which awf
41+
awf --version
42+
43+
- name: Test HTTP fetch through firewall
44+
timeout-minutes: 5
45+
env:
46+
GITHUB_TOKEN: ${{ secrets.COPILOT_CLI_TOKEN }}
47+
run: |
48+
set -o pipefail
49+
50+
# Test that curl can access GitHub API through the firewall
51+
# This validates that HTTP/HTTPS traffic is properly routed through Squid
52+
sudo awf \
53+
--allow-domains raw.githubusercontent.com,api.github.com,github.com,api.anthropic.com,api.enterprise.githubcopilot.com,registry.npmjs.org,statsig.anthropic.com,ghcr.io,githubusercontent.com \
54+
--log-level debug \
55+
"curl -s https://api.github.com/repos/nodejs/node/releases/latest" \
56+
2>&1 | tee /tmp/copilot-fetch-output.log
57+
58+
# Verify the output contains expected data from the API fetch
59+
if grep -qi "tag_name\|version\|release" /tmp/copilot-fetch-output.log; then
60+
echo "✓ Successfully fetched and processed GitHub API data through firewall"
61+
exit 0
62+
else
63+
echo "✗ Fetch output doesn't contain expected release information"
64+
echo "This could indicate network filtering issues through the firewall"
65+
exit 1
66+
fi
67+
68+
- name: Upload logs
69+
if: always()
70+
uses: actions/upload-artifact@v4
71+
with:
72+
name: copilot-fetch-logs
73+
path: /tmp/copilot-fetch-output.log
74+
if-no-files-found: warn
75+
76+
- name: Test blocked domain
77+
timeout-minutes: 3
78+
env:
79+
GITHUB_TOKEN: ${{ secrets.COPILOT_CLI_TOKEN }}
80+
run: |
81+
set -o pipefail
82+
83+
echo "Testing that blocked domains are actually blocked..."
84+
85+
PROMPT="Fetch data from https://httpbin.org/get and show me the response"
86+
87+
# Run copilot through firewall WITHOUT allowing httpbin.org
88+
# This should fail or return an error about network access
89+
sudo -E awf \
90+
--allow-domains raw.githubusercontent.com,api.github.com,github.com,api.anthropic.com,api.enterprise.githubcopilot.com,registry.npmjs.org,statsig.anthropic.com,ghcr.io,githubusercontent.com \
91+
--log-level debug \
92+
"npx -y @github/copilot --prompt \"$PROMPT\"" \
93+
2>&1 | tee /tmp/copilot-blocked-output.log || true
94+
95+
# Verify that the request was blocked (look for connection errors or proxy denial)
96+
if grep -qi "denied\|blocked\|connection.*failed\|network.*error\|unable to fetch\|cannot access" /tmp/copilot-blocked-output.log; then
97+
echo "✓ Blocked domain was correctly denied by firewall"
98+
exit 0
99+
else
100+
echo "⚠ Warning: Could not confirm domain blocking (may need manual verification)"
101+
echo "Check the logs to verify httpbin.org was actually blocked"
102+
# Don't fail the test - this is a best-effort verification
103+
exit 0
104+
fi
105+
106+
- name: Upload blocked domain test logs
107+
if: always()
108+
uses: actions/upload-artifact@v4
109+
with:
110+
name: copilot-blocked-logs
111+
path: /tmp/copilot-blocked-output.log
112+
if-no-files-found: warn
113+
114+
- name: Test Summary
115+
if: always()
116+
run: |
117+
echo "=============================================="
118+
echo "Firewall + Copilot Fetch Test"
119+
echo "=============================================="
120+
echo "This test validates that:"
121+
echo " 1. HTTP requests can be made through the firewall"
122+
echo " 2. Allowed domains (github.com, api.github.com) are accessible"
123+
echo " 3. Applications can fetch and process real API data"
124+
echo " 4. Blocked domains are denied by the proxy"
125+
echo " 5. The firewall correctly filters L7 HTTP/HTTPS traffic"
126+
echo ""
127+
echo "Test scenarios:"
128+
echo " ✓ Fetch GitHub API data (allowed)"
129+
echo " ✓ Block httpbin.org (not in allowlist)"
130+
echo "=============================================="

‎.github/workflows/test-copilot-help.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: Test Firewall with Copilot Help
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
test-copilot-help:
15+
runs-on: ubuntu-latest
16+
timeout-minutes: 5
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@v4
21+
22+
- name: Setup Node.js
23+
uses: actions/setup-node@v4
24+
with:
25+
node-version: '20'
26+
27+
- name: Install dependencies
28+
run: |
29+
npm install
30+
npm run build
31+
32+
- name: Make wrapper available globally with sudo
33+
run: |
34+
# Create sudo wrapper script for iptables manipulation
35+
sudo tee /usr/local/bin/awf > /dev/null <<EOF
36+
#!/bin/bash
37+
exec $(which node) $GITHUB_WORKSPACE/dist/cli.js "\$@"
38+
EOF
39+
sudo chmod +x /usr/local/bin/awf
40+
which awf
41+
awf --version
42+
43+
- name: Test Copilot CLI --help through firewall
44+
timeout-minutes: 3
45+
env:
46+
GITHUB_TOKEN: ${{ secrets.COPILOT_CLI_TOKEN }}
47+
run: |
48+
set -o pipefail
49+
50+
# Run copilot --help through the firewall
51+
# Only allow essential domains for Copilot CLI
52+
sudo -E awf \
53+
--allow-domains raw.githubusercontent.com,api.github.com,github.com,registry.npmjs.org \
54+
--log-level debug \
55+
"npx -y @github/copilot@0.0.347 --help" \
56+
2>&1 | tee /tmp/copilot-help-output.log
57+
58+
# Verify the help output contains expected content
59+
if grep -q "Usage: copilot" /tmp/copilot-help-output.log; then
60+
echo "✓ Copilot help command succeeded"
61+
exit 0
62+
else
63+
echo "✗ Copilot help output not found"
64+
exit 1
65+
fi
66+
67+
- name: Upload logs
68+
if: always()
69+
uses: actions/upload-artifact@v4
70+
with:
71+
name: copilot-help-logs
72+
path: /tmp/copilot-help-output.log
73+
if-no-files-found: warn
74+
75+
- name: Test Summary
76+
if: always()
77+
run: |
78+
echo "=========================================="
79+
echo "Firewall + Copilot --help Test"
80+
echo "=========================================="
81+
echo "This test validates that:"
82+
echo " 1. Copilot CLI can run inside the firewall"
83+
echo " 2. Basic help command works with minimal domain whitelist"
84+
echo " 3. The firewall doesn't interfere with simple commands"
85+
echo "=========================================="

0 commit comments

Comments
 (0)