Motivation
github/gh-aw#56592 — Add npm registry allowlist to affected workflows, part of ongoing sandbox/network egress allowlisting work (related also to #56653 "Preserve GitHub expression operators in safe-output JSON").
Proposed test
- Workflow file:
test-copilot-network-npm-registry-allowlist.md
- Trigger:
workflow_dispatch
- Engine: copilot
- Safe output:
create-issue
- Variant: standard (sandboxed, so the network allowlist is actually enforced)
Minimal test prompt sketch
Configure the workflow's network frontmatter to allow the npm registry domain, have the agent run npm view <package> version (or similar registry read) inside its sandbox, and create an issue reporting the fetched version — proving the npm registry allowlist entry permits the request while other unlisted domains remain blocked (as already covered by test-copilot-network-isolation.md for the deny path).
New fixtures or secrets needed
None — npm registry is a public read-only endpoint.
Notes
Existing test-copilot-network-isolation.md only proves egress isolation broadly; it doesn't exercise a specific configured allowlist domain like the npm registry. This complements it. Confirm gh-aw's network: frontmatter syntax for domain allowlisting before writing the compilable source (may need to check current allowed-domains list format, e.g. ecosystems: [node] vs explicit domain).
Generated by 🔍 Suggest New E2E Tests · auto · 27.6 AIC · ⌖ 1.9 AIC · ⊞ 8.3K · ◷
Motivation
github/gh-aw#56592 — Add npm registry allowlist to affected workflows, part of ongoing sandbox/network egress allowlisting work (related also to #56653 "Preserve GitHub expression operators in safe-output JSON").
Proposed test
test-copilot-network-npm-registry-allowlist.mdworkflow_dispatchcreate-issueMinimal test prompt sketch
Configure the workflow's
networkfrontmatter to allow the npm registry domain, have the agent runnpm view <package> version(or similar registry read) inside its sandbox, and create an issue reporting the fetched version — proving the npm registry allowlist entry permits the request while other unlisted domains remain blocked (as already covered bytest-copilot-network-isolation.mdfor the deny path).New fixtures or secrets needed
None — npm registry is a public read-only endpoint.
Notes
Existing
test-copilot-network-isolation.mdonly proves egress isolation broadly; it doesn't exercise a specific configured allowlist domain like the npm registry. This complements it. Confirm gh-aw'snetwork:frontmatter syntax for domain allowlisting before writing the compilable source (may need to check current allowed-domains list format, e.g.ecosystems: [node]vs explicit domain).