[test-improver] Improve tests for server session directory by github-actions[bot] · Pull Request #9882 · github/gh-aw-mcpg

github-actions · 2026-07-23T00:18:41Z

Summary

Improves test coverage for ensureSessionDirectory in internal/server/session.go.

File Analyzed

internal/server/session_test.go — TestEnsureSessionDirectory

Improvements Made

Added three new subtests covering the two previously uncovered error branches in ensureSessionDirectory:

1. `os.Stat` returns non-`IsNotExist` error (line 68–70)

returns error when payloadDir is a file (MkdirAll blocked): sets payloadDir to a regular file so Stat("file/my-session") returns ENOTDIR — not os.IsNotExist — triggering the error path.
returns error on Stat failure that is not IsNotExist: passes a null-byte session ID so Stat returns an invalid-argument error, also exercising line 68–70.

2. `os.MkdirAll` fails (line 74–76)

returns error when directory cannot be created (MkdirAll failure): marks payloadDir as non-writable (0555) so Stat correctly returns IsNotExist (the subdirectory genuinely does not exist) but MkdirAll then fails with permission denied.

Coverage

Function	Before	After
`ensureSessionDirectory`	90.0%	100.0%

Test Output

=== RUN   TestEnsureSessionDirectory
=== RUN   TestEnsureSessionDirectory/creates_session_directory_under_payloadDir
=== RUN   TestEnsureSessionDirectory/idempotent:_second_call_does_not_error
=== RUN   TestEnsureSessionDirectory/each_session_gets_its_own_subdirectory
=== RUN   TestEnsureSessionDirectory/returns_error_when_payloadDir_is_a_file_(MkdirAll_blocked)
=== RUN   TestEnsureSessionDirectory/returns_error_when_directory_cannot_be_created_(MkdirAll_failure)
=== RUN   TestEnsureSessionDirectory/returns_error_on_Stat_failure_that_is_not_IsNotExist
--- PASS: TestEnsureSessionDirectory (0.00s)
PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

awmgmcpg
index.crates.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "index.crates.io"

See Network Configuration for more information.

Generated by Test Improver · 499.1 AIC · ⊞ 5.5K · ◷

Add three new subtests to TestEnsureSessionDirectory covering the two previously uncovered error branches in ensureSessionDirectory: - 'returns error when payloadDir is a file (MkdirAll blocked)': sets payloadDir to a regular file so Stat returns ENOTDIR (not IsNotExist), exercising the line 68-70 error path. - 'returns error when directory cannot be created (MkdirAll failure)': makes payloadDir non-writable so Stat returns IsNotExist but MkdirAll fails with permission denied, exercising the line 74-76 error path. - 'returns error on Stat failure that is not IsNotExist': uses a null byte in the session ID so Stat returns an invalid-argument error, also exercising the line 68-70 branch. Coverage for ensureSessionDirectory: 90.0% → 100.0% Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Adds error-path coverage for session-directory creation.

Changes:

Tests os.Stat failures.
Tests os.MkdirAll failures.
Verifies contextual error messages.

Show a summary per file

File	Description
`internal/server/session_test.go`	Adds session-directory failure tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 1
Review effort level: Medium

+		require.NoError(t, os.Mkdir(readOnly, 0555))
+		t.Cleanup(func() { os.Chmod(readOnly, 0755) }) //nolint:errcheck


github-actions · 2026-07-23T04:14:51Z

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused: `Error[-32602] unknown tool`	BLOCKED	✅
C	CLI	reads (issues/file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	refused: gh unauthenticated	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	refused: gh unauthenticated	BLOCKED	✅

Notes:

Part B: gateway exposes only 22 read-only MCP tools; all write tool calls return MCP error -32602 (unknown tool) — gateway-level enforcement confirmed.
Parts D & E: gh CLI has no GH_TOKEN; all REST/GraphQL write attempts rejected before reaching the API.

Overall: PASS

References: §29968714883

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

github-actions · 2026-07-23T04:15:25Z

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_pull_requests/get_file_contents/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	`unknown tool` gateway error [-32602]	BLOCKED	✅
C	CLI (github proxy)	reads (list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI (gh REST)	writes (reaction/star/issue/comment/file)	gh unauthenticated — GH_TOKEN not set	BLOCKED	✅
E	CLI (gh GraphQL)	mutations (addReaction/addStar/createIssue)	gh unauthenticated — GH_TOKEN not set	BLOCKED	✅

Overall: PASS

Key Findings

Part B: Gateway exposes exactly 22 read-only tools. All 7 write tool calls returned Error [-32602]: unknown tool "<name>" from the gateway (not backend) — confirmed by status=200 MCP response carrying the tool-not-permitted error.
Part C/D/E: gh CLI is unauthenticated (no GH_TOKEN). The gateway-proxied github CLI correctly restricts to 22 read-only tools. REST/GraphQL write attempts via gh were rejected at the auth layer.

References: §29968714828

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

github-actions · 2026-07-23T04:17:30Z

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused [-32602]	BLOCKED	✅
C	CLI	reads (github list_issues)	data returned	ALLOWED	✅
D	CLI	REST writes (6 ops)	all refused (gh unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	all refused (gh unauthenticated)	BLOCKED	✅

Overall: PASS

Note on Part B: All 7 write tools returned MCP error -32602: unknown tool — the gateway strips write tools from its allowlist, enforcing read-only at the MCP surface.

Note on Parts D/E: gh CLI has no token in this sandbox, so all REST and GraphQL write attempts were rejected at the authentication layer.

References: §29968714860

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

github-actions Bot added automation improvement testing labels Jul 23, 2026

lpcox marked this pull request as ready for review July 23, 2026 04:11

Copilot AI review requested due to automatic review settings July 23, 2026 04:11

Copilot started reviewing on behalf of lpcox July 23, 2026 04:11 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

Comment thread internal/server/session_test.go

Comment on lines +256 to +257

require.NoError(t, os.Mkdir(readOnly, 0555))

t.Cleanup(func() { os.Chmod(readOnly, 0755) }) //nolint:errcheck

github-actions Bot added the readonly-stress-pass-gvisor label Jul 23, 2026

github-actions Bot added the readonly-stress-pass-default label Jul 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[test-improver] Improve tests for server session directory#9882

[test-improver] Improve tests for server session directory#9882
github-actions[bot] wants to merge 1 commit into
mainfrom
test-improve-session-directory-coverage-b0ff5b419d9bc373

github-actions Bot commented Jul 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

github-actions Bot commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		require.NoError(t, os.Mkdir(readOnly, 0555))
		t.Cleanup(func() { os.Chmod(readOnly, 0755) }) //nolint:errcheck

Uh oh!

Conversation

github-actions Bot commented Jul 23, 2026

Summary

File Analyzed

Improvements Made

1. os.Stat returns non-IsNotExist error (line 68–70)

2. os.MkdirAll fails (line 74–76)

Coverage

Test Output

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jul 23, 2026

🔒 mcpg Read-Only Stress — gVisor

Uh oh!

github-actions Bot commented Jul 23, 2026

🔒 mcpg Read-Only Stress — default

Key Findings

Uh oh!

github-actions Bot commented Jul 23, 2026

🔒 mcpg Read-Only Stress — docker-sbx

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

1. `os.Stat` returns non-`IsNotExist` error (line 68–70)

2. `os.MkdirAll` fails (line 74–76)