fix(benchmark): mount adversarial_dojo into AWF container and pass API keys

.github/workflows/red-team-benchmark.md

@@ -176,13 +176,23 @@ steps:
         echo '{"skipped":false,"reason":"missing claude binary"}' > /tmp/gh-aw/agent/awf/summary.json
         exit 1
       else
-        cd /tmp/adversarial_dojo
         # Run the benchmark inside AWF sandbox — benchmark traffic is restricted
         # to api.anthropic.com and api.openai.com, blocking other egress attempts.
+        # Mount adversarial_dojo (with its uv-managed venv), the uv binary, config
+        # files and the output directory so the benchmark tooling is available
+        # inside the minimal AWF container image.
         sudo awf \
           --allow-domains api.anthropic.com,api.openai.com \
           --proxy-logs-dir /tmp/gh-aw/agent/awf/firewall-logs \
           --log-level info \
+          --mount /tmp/adversarial_dojo:/tmp/adversarial_dojo \
+          --mount "$HOME/.local/bin/uv:$HOME/.local/bin/uv:ro" \
+          --mount /tmp/awf-benchmark.toml:/tmp/awf-benchmark.toml:ro \
+          --mount /tmp/awf-benchmark:/tmp/awf-benchmark:ro \
+          --mount /tmp/gh-aw/agent/awf:/tmp/gh-aw/agent/awf \
+          --container-workdir /tmp/adversarial_dojo \
+          --env "ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY" \
+          --env "OPENAI_API_KEY=$OPENAI_API_KEY" \
           -- "$HOME/.local/bin/uv" run adversarial-dojo search-attacks \
           /tmp/awf-benchmark.toml \
           --out /tmp/gh-aw/agent/awf \

scripts/ci/red-team-benchmark-workflow.test.ts

@@ -69,6 +69,16 @@ describe('red-team benchmark workflow config', () => {
     expect(source).toContain('--allow-domains api.anthropic.com,api.openai.com');
     expect(source).toContain('--proxy-logs-dir /tmp/gh-aw/agent/awf/firewall-logs');
 
+    // adversarial_dojo tooling is mounted into the AWF container
+    expect(source).toContain('--mount /tmp/adversarial_dojo:/tmp/adversarial_dojo');
+    expect(source).toContain('--mount /tmp/awf-benchmark.toml:/tmp/awf-benchmark.toml:ro');
+    expect(source).toContain('--mount /tmp/gh-aw/agent/awf:/tmp/gh-aw/agent/awf');
+    expect(source).toContain('--container-workdir /tmp/adversarial_dojo');
+
+    // API keys are explicitly forwarded to the AWF container
+    expect(source).toContain('--env "ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY"');
+    expect(source).toContain('--env "OPENAI_API_KEY=$OPENAI_API_KEY"');
+
     // Both benchmark runs
     expect(source).toContain('Run baseline benchmark (victim without AWF)');
     expect(source).toContain('Run AWF-protected benchmark (victim inside AWF sandbox)');
@@ -141,6 +151,10 @@ describe('red-team benchmark workflow config', () => {
     expect(lock).toContain('f51227612e43d98658679710d5505989e7f53ec7');
     expect(lock).toContain('--out');
 
+    // adversarial_dojo mounts compiled into lock
+    expect(lock).toContain('--mount /tmp/adversarial_dojo:/tmp/adversarial_dojo');
+    expect(lock).toContain('--container-workdir /tmp/adversarial_dojo');
+
     // Benchmark steps present
     expect(lock).toContain('baseline');
     expect(lock).toContain('awf_run');