Expose Azure CLI state and ADO auth token inside AWF sandbox by Copilot · Pull Request #6690 · github/gh-aw-firewall

Copilot · 2026-07-28T16:39:34Z

Azure CLI/ADO auth was breaking in-sandbox because ~/.azure was not mounted and ADO_MCP_AUTH_TOKEN/AZURE_CONFIG_DIR were not forwarded to the agent environment under API-proxy mode. This change aligns mount policy and env passthrough so runner-provisioned Azure/ADO auth is available inside the agent.

Home mount policy: allow Azure CLI state
- Added .azure to home.toolSubdirs in the canonical sandbox mount policy.
- Removed .azure from home.forbiddenSubdirs so compose + sbx runtimes can mount it consistently.
- Updated related policy/runtime docs and assertions to reflect the new allowlist.
Agent env passthrough: propagate Azure/ADO auth inputs
- Added AZURE_CONFIG_DIR and ADO_MCP_AUTH_TOKEN to always-forwarded host env vars in agent env assembly.
- Keeps existing credential isolation behavior intact while enabling Azure/ADO MCP auth flows.
Targeted coverage updates
- Added focused tests for:
  - .azure presence in mounted home tool directories
  - passthrough of AZURE_CONFIG_DIR
  - passthrough of ADO_MCP_AUTH_TOKEN
- Updated mount-policy whitelist/forbidden-list expectations accordingly.

// src/services/agent-environment/env-passthrough.ts
const alwaysForwardVars = [
  // ...
  'ACTIONS_ID_TOKEN_REQUEST_URL',
  'ACTIONS_ID_TOKEN_REQUEST_TOKEN',
  'AZURE_CONFIG_DIR',
  'ADO_MCP_AUTH_TOKEN',
  // ...
] as const;

Fixes [awf] agent: Azure CLI and ADO authentication not available inside sandbox #6686

Copilot

Pull request overview

Enables Azure CLI and Azure DevOps authentication inside AWF sandboxes.

Changes:

Mounts ~/.azure across sandbox runtimes.
Forwards Azure configuration and ADO authentication variables.
Updates targeted tests and sbx documentation.

Show a summary per file

File	Description
`src/config/sandbox-mount-policy.json`	Adds `.azure` to mounted home directories.
`src/config/mount-policy.test.ts`	Verifies the Azure mount policy.
`src/services/agent-volumes/home-whitelist.test.ts`	Updates allowlist and denylist assertions.
`src/services/agent-volumes/home-strategy.test.ts`	Tests the compose Azure mount.
`src/services/agent-environment/env-passthrough.ts`	Forwards Azure/ADO environment variables.
`src/services/agent-environment/env-passthrough.test.ts`	Tests the new passthrough behavior.
`src/sbx-manager.ts`	Updates credential-store commentary.
`docs/sbx-integration.md`	Documents the sbx Azure directory mount.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 8/8 changed files
Comments generated: 3
Review effort level: Medium

    'ACTIONS_ID_TOKEN_REQUEST_URL',
    'ACTIONS_ID_TOKEN_REQUEST_TOKEN',
+    'AZURE_CONFIG_DIR',
+    'ADO_MCP_AUTH_TOKEN',


      ".cache",
      ".config",
      ".local",
+      ".azure",


+     the host from `HOME_TOOL_SUBDIRS` (`.cache`, `.config`, `.local`, `.azure`,
     `.anthropic`, `.claude`, `.cargo`, `.rustup`, `.npm`, `.nvm`) plus the agent
     state dirs `.copilot` and `.gemini`. Credential-store dirs such as `.aws`,
-     `.ssh`, `.docker`, `.kube`, `.azure` and `.gnupg` are **never** whitelisted,
+     `.ssh`, `.docker`, `.kube`, and `.gnupg` are **never** whitelisted,
     so they never enter the VM. Each whitelisted dir is mounted **wholesale** (as


lpcox · 2026-07-28T17:12:38Z

@copilot address review feedback

Copilot · 2026-07-28T17:21:20Z

@copilot address review feedback

Addressed all three review issues in f3dd899:

1. ADO_MCP_AUTH_TOKEN in AWF_ONE_SHOT_TOKENS (core-environment.ts)
Added ADO_MCP_AUTH_TOKEN to the one-shot token list so it is cleared from /proc/self/environ after container startup, consistent with how other bearer credentials are protected.

2. .azure credential-bearing mount modeled as an exception (sandbox-mount-policy.json)
Rather than treating .azure as ordinary tool state, the policy now explicitly documents it as a credential-bearing exception and adds the live Azure CLI token caches to the credentials deny list:

.azure/msal_token_cache.bin
.azure/msal_token_cache.json
.azure/accessTokens.json
.azure/service_principal_entries.json

These are masked via /dev/null overlays (compose) or moved aside before sandbox creation (sbx), consistent with how other nested credential stores (.config/gcloud, .cargo/credentials, etc.) are handled. The policy comment now makes the threat model explicit: .azure is mounted for Azure CLI config/metadata, but live tokens are never accessible to the agent — Azure auth must come via OIDC (ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN) or ADO_MCP_AUTH_TOKEN.

3. Documentation corrected (docs/sbx-integration.md)
The .azure mount is now documented as a credential-bearing exception with a callout explaining what is masked and how auth works. The "Scrubbing nested credential stores" section is updated to include the Azure token cache files.

github-actions · 2026-07-28T19:00:35Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-07-28T19:00:59Z

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit edc6a7f

github-actions · 2026-07-28T19:02:52Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	99.17%	99.20%	📈 +0.03%
Statements	99.07%	99.10%	📈 +0.03%
Functions	99.45%	99.45%	➡️ +0.00%
Branches	95.75%	95.75%	➡️ +0.00%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-07-28T22:13:27Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-07-28T22:13:30Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

github-actions · 2026-07-28T22:13:34Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

github-actions · 2026-07-28T22:13:35Z

🔌 Smoke Services — All services reachable! ✅

github-actions · 2026-07-28T22:13:35Z

✅ Smoke Gemini completed. All facets verified. 💎

Smoke test completed with FAIL status. Comment added to PR #6690.

github-actions · 2026-07-28T22:13:36Z

✅ Contribution Check completed successfully!

Contribution check complete — no issues found. The PR includes targeted tests for the new Azure CLI/auth behavior, updates documentation for the mount policy change, references a related issue (#6686), and keeps new files in the expected src/docs locations.

github-actions · 2026-07-28T22:13:36Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-28T22:13:38Z

✅ Build Test Suite completed successfully!

github-actions · 2026-07-28T22:13:38Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

github-actions · 2026-07-28T22:13:42Z

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-07-28T22:13:44Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

github-actions · 2026-07-28T22:13:47Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

github-actions · 2026-07-28T22:13:47Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

github-actions · 2026-07-28T22:13:53Z

✅ Smoke Claude passed

github-actions · 2026-07-28T22:15:07Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-07-28T22:15:30Z

🔬 Smoke Test Results

Test	Result
GitHub MCP connectivity	✅ Connected (secrecy-filtered response)
GitHub.com HTTP	✅ 200 OK
File write/read	⚠️ Pre-step outputs not substituted

Overall: PASS (core connectivity verified)

Author: @lpcox

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-28T22:15:43Z

🔥 Smoke Test: Copilot Network Isolation

@lpcox

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (api.github.com) — HTTP 200
✅ Blocked domain (example.com) — CONNECT tunnel failed (403), blocked as expected

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-07-28T22:15:58Z

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ `host.docker.internal` DNS resolution failed
PostgreSQL pg_isready	❌ no response
PostgreSQL SELECT 1	❌ DNS resolution failed

Overall: FAIL — host.docker.internal is not resolvable in this environment.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-07-28T22:16:06Z

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
S1: Module Loading	✅ Pass	`otel.js` loads successfully; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled`, plus internal helpers
S2: Test Suite	✅ Pass	59 tests passed, 0 failed across `otel.test.js` and `otel-fanout.test.js`
S3: Env Var Forwarding	✅ Pass	`src/services/api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, and `OTEL_SERVICE_NAME`
S4: Token Tracker Integration	✅ Pass	`onUsage` callback exists in `token-tracker-http.js` (line 348/406); invoked after normalized usage is extracted
S5: OTEL Diagnostics	✅ Pass	Module loads and exports verified; graceful degradation confirmed (no errors when unconfigured)

All 5 scenarios pass. The OTEL tracing integration is working correctly.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-07-28T22:16:30Z

Smoke Test: Copilot BYOK (Direct) — PASS

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP 200	✅
File write/read	✅
BYOK inference (this response)	✅

Overall: PASS

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-07-28T22:16:40Z

Gemini Smoke Test Results

GitHub MCP: ❌ (PRs feat(api-proxy): use runtime model metadata and pricing overlays #6695, chore: upgrade gh-aw extension to v0.83.4 pre-release and recompile workflows #6681 filtered)
Connectivity: ❌ (HTTP 000)
File Writing: ✅
Bash Tool: ✅

Overall Status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

github-actions · 2026-07-28T22:16:56Z

Smoke Test: Claude Engine Validation

Check	Result
API Status	✅ PASS
GH Check	✅ PASS
File Status	✅ PASS

Overall Result: ✅ PASS

Generated by Smoke Claude for #6690 · haiku45 · 31.5 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-28T22:17:46Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for #6690 · sonnet46 · 43.5 AIC · ⊞ 8.4K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-07-28T22:17:52Z

Chroot Smoke Test Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.13	✅ YES
Node.js	v24.18.0	v22.23.1	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: ❌ FAILED — Node.js version mismatch between host and chroot environment.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions · 2026-07-28T22:18:12Z

🧪 Smoke Test Results — Docker Sbx

Test	Status
GitHub MCP connectivity	✅ Connected (results filtered by policy)
GitHub.com HTTP	⚠️ Pre-step data not interpolated
File write/read	⚠️ Pre-step data not interpolated

Overall: ⚠️ PARTIAL — MCP connectivity confirmed; pre-computed step outputs were not interpolated into the prompt (raw ${{ }} literals received). @lpcox please check workflow step ordering.

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}

github-actions · 2026-07-28T22:18:26Z

Merged PRs reviewed:

feat(api-proxy): use runtime model metadata and pricing overlays
chore: upgrade gh-aw extension to v0.83.4 pre-release and recompile workflows

✅ Playwright GitHub title check
✅ Smoke file write and verification
✅ Discussion lookup found #6698
❌ npm ci && npm run build

Overall: FAIL

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

Initial plan

5bc81c3

Copilot AI assigned Copilot and lpcox Jul 28, 2026

Copilot started work on behalf of lpcox July 28, 2026 16:40 View session

Copilot AI linked an issue Jul 28, 2026 that may be closed by this pull request

[awf] agent: Azure CLI and ADO authentication not available inside sandbox #6686

Closed

fix: allow azure cli auth state and ado token passthrough

e341a16

Copilot AI changed the title ~~[WIP] Fix Azure CLI and ADO authentication issues in sandbox~~ Expose Azure CLI state and ADO auth token inside AWF sandbox Jul 28, 2026

Copilot AI requested a review from lpcox July 28, 2026 16:45

Copilot finished work on behalf of lpcox July 28, 2026 16:45

lpcox marked this pull request as ready for review July 28, 2026 16:48

Copilot AI review requested due to automatic review settings July 28, 2026 16:48

Copilot started reviewing on behalf of lpcox July 28, 2026 16:48 View session

Copilot AI reviewed Jul 28, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 28, 2026 17:13 View session

fix: protect ADO_MCP_AUTH_TOKEN and mask Azure MSAL token caches

f3dd899

Copilot finished work on behalf of lpcox July 28, 2026 17:21

lpcox added the ready-for-aw label Jul 28, 2026

lpcox had a problem deploying to aoai-model July 28, 2026 22:13 — with GitHub Actions Failure

github-actions Bot added the smoke-copilot label Jul 28, 2026

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Jul 28, 2026

lpcox temporarily deployed to aoai-model July 28, 2026 22:16 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok label Jul 28, 2026

github-actions Bot added the smoke-claude label Jul 28, 2026

github-actions Bot added the build-test label Jul 28, 2026

lpcox merged commit 01e3c8f into main Jul 28, 2026
138 of 141 checks passed

lpcox deleted the copilot/awf-fix-azure-cli-authentication branch July 28, 2026 22:42

Uh oh!

Conversation

Copilot AI commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

lpcox commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Documentation Preview

Uh oh!

github-actions Bot commented Jul 28, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

🔬 Smoke Test Results

Uh oh!

github-actions Bot commented Jul 28, 2026

🔥 Smoke Test: Copilot Network Isolation

Uh oh!

github-actions Bot commented Jul 28, 2026

Smoke Test: GitHub Actions Services Connectivity

Uh oh!

github-actions Bot commented Jul 28, 2026

Smoke Test: API Proxy OpenTelemetry Tracing

Uh oh!

github-actions Bot commented Jul 28, 2026

Copilot AI commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading