Suggested test: copilot/network-engine-domain-explicit-opt-in

[github-actions]

Motivation

Link to the gh-aw PR: github/gh-aw#56447 — "Make engine domain sets explicit opt-in"

Compiler no longer auto-merges agent engine domain sets (e.g. copilot, claude, codex) into firewall allow-lists; workflows must reference them explicitly in network.allowed, like defaults/other domain sets. No existing test in existing-tests.json exercises network.allowed domain-set resolution or firewall behavior when the engine domain set is omitted vs included.

Proposed test

• Workflow file: test-copilot-network-engine-domain-opt-in.md
• Trigger: workflow_dispatch
• Engine: copilot
• Safe output: create-issue
• Variant: standard

Minimal test prompt sketch

Configure network: { allowed: [defaults, copilot] } explicitly in frontmatter, then have the agent make a trivial network-dependent action (or just report success) and create an issue confirming the firewall allowed the copilot domain set — verifying the explicit opt-in resolves correctly post-compile.

New fixtures or secrets needed

None — reuses githubnext/gh-aw-test.

Notes

Existing test-copilot-network-isolation.md tests default sandboxing/isolation but does not exercise the new explicit network.allowed engine-domain-set opt-in behavior. Worth confirming via gh aw compile that the lockfile firewall config differs based on whether copilot is listed.

Generated by 🔍 Suggest New E2E Tests · copilot · auto · 22.6 AIC · ⌖ 3.81 AIC · ⊞ 8.8K · ◷