From cd217f9709da5ed3a34eaccdc205afdaff14f968 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 13 Jul 2026 00:38:51 +0000 Subject: [PATCH 1/4] Initial plan From 4ae11ac278f012a02d55d94a06b045ffc1ccec42 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 13 Jul 2026 00:40:17 +0000 Subject: [PATCH 2/4] docs: add D5 failure mode (stale gVisor release pin) to runner doctor catalogs --- .github/agents/self-hosted-runner-doctor.md | 2 ++ .github/workflows/shared/self-hosted-failure-modes.md | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/agents/self-hosted-runner-doctor.md b/.github/agents/self-hosted-runner-doctor.md index 06c71d69b..c3d1e235e 100644 --- a/.github/agents/self-hosted-runner-doctor.md +++ b/.github/agents/self-hosted-runner-doctor.md @@ -210,6 +210,7 @@ Establish these facts before matching a failure mode: | D2 | cli-proxy fails on IPv6-enabled runners | The tunnel was bound only to `127.0.0.1` | Fixed by dual-stack binding | Check `ss -tlnp` inside `awf-cli-proxy` | #4626 | | D3 | `--enable-dind` still exists after DinD removal | Legacy flag cleanup is incomplete | Known unresolved cleanup item | `awf --help | grep enable-dind` | #1727 | | D4 | Enterprise LLM gateway needs an injected auth header | API proxy lacks a user extension point for that hop | Known unresolved proposal | No general probe; capture the required header flow in the report | #4849 | +| D5 | gVisor install step exits with `HTTP 404` / download failure; `runsc` binary not found; AWF exits with `runtime 'gvisor' is not available` or compose up fails immediately after `--container-runtime gvisor` | The AWF-compiler-generated gVisor install step (or smoke-test lock files) hardcodes a specific gVisor release tag (e.g. `20250623.0`); Google removes old releases from `storage.googleapis.com`, so the download returns 404 | Update gVisor lock files to the latest pinned release (`20250707.0` or newer); upgrade to the AWF version after PR github/gh-aw-firewall#6143 | `curl -sI https://storage.googleapis.com/gvisor/releases/release/20250623.0/x86_64/runsc` — HTTP 404 confirms a stale pin | github/gh-aw-firewall#6143 | ## Error-string quick lookup @@ -240,6 +241,7 @@ Establish these facts before matching a failure mode: | `getent passwd ` fails or `HOME=/`, `USER=root` in chroot | A6 | | Bind-mounted `/tmp/...` files are missing inside DinD containers | A1 | | `diagnosis=unknown` from `awf-cli-proxy` DIFC probe (proxy reachable, no connection error) with `GITHUB_SERVER_URL=*.ghe.com`, or `diagnosis=reachable-but-api-error (HTTP NNN)` | C7 | +| `HTTP 404` / `404 Not Found` downloading `runsc` from `storage.googleapis.com` during gVisor install | D5 | ## Known unresolved items diff --git a/.github/workflows/shared/self-hosted-failure-modes.md b/.github/workflows/shared/self-hosted-failure-modes.md index d69785540..0fb88b44a 100644 --- a/.github/workflows/shared/self-hosted-failure-modes.md +++ b/.github/workflows/shared/self-hosted-failure-modes.md @@ -72,6 +72,7 @@ Establish these facts before matching a failure mode: | D2 | cli-proxy fails on IPv6-enabled runners | The tunnel was bound only to `127.0.0.1` | Fixed by dual-stack binding | Check `ss -tlnp` inside `awf-cli-proxy` | #4626 | | D3 | `--enable-dind` still exists after DinD removal | Legacy flag cleanup is incomplete | Known unresolved cleanup item | `awf --help | grep enable-dind` | #1727 | | D4 | Enterprise LLM gateway needs an injected auth header | API proxy lacks a user extension point for that hop | Known unresolved proposal | No general probe; capture the required header flow in the report | #4849 | +| D5 | gVisor install step exits with `HTTP 404` / download failure; `runsc` binary not found; AWF exits with `runtime 'gvisor' is not available` or compose up fails immediately after `--container-runtime gvisor` | The AWF-compiler-generated gVisor install step (or smoke-test lock files) hardcodes a specific gVisor release tag (e.g. `20250623.0`); Google removes old releases from `storage.googleapis.com`, so the download returns 404 | Update gVisor lock files to the latest pinned release (`20250707.0` or newer): in your AWF config set `gvisor.releaseTag` to the newest valid tag, or upgrade to the AWF version after PR github/gh-aw-firewall#6143 which bumped all smoke-test lock files | `curl -sI https://storage.googleapis.com/gvisor/releases/release/20250623.0/x86_64/runsc` — HTTP 404 confirms a stale pin; replace tag with `20250707.0` and retry | github/gh-aw-firewall#6143 | ## Error-string quick lookup @@ -102,6 +103,7 @@ Establish these facts before matching a failure mode: | `getent passwd ` fails or `HOME=/`, `USER=root` in chroot | A6 | | Bind-mounted `/tmp/...` files are missing inside DinD containers | A1 | | `diagnosis=unknown` from `awf-cli-proxy` DIFC probe (proxy reachable, no connection error) with `GITHUB_SERVER_URL=*.ghe.com`, or `diagnosis=reachable-but-api-error (HTTP NNN)` | C7 | +| `HTTP 404` / `404 Not Found` downloading `runsc` from `storage.googleapis.com` during gVisor install | D5 | ## Known unresolved items From beab09f7c925cb87ee672c978ec5acd07a092474 Mon Sep 17 00:00:00 2001 From: Landon Cox Date: Sun, 12 Jul 2026 18:38:25 -0700 Subject: [PATCH 3/4] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/agents/self-hosted-runner-doctor.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/agents/self-hosted-runner-doctor.md b/.github/agents/self-hosted-runner-doctor.md index c3d1e235e..b1afd2a70 100644 --- a/.github/agents/self-hosted-runner-doctor.md +++ b/.github/agents/self-hosted-runner-doctor.md @@ -210,7 +210,7 @@ Establish these facts before matching a failure mode: | D2 | cli-proxy fails on IPv6-enabled runners | The tunnel was bound only to `127.0.0.1` | Fixed by dual-stack binding | Check `ss -tlnp` inside `awf-cli-proxy` | #4626 | | D3 | `--enable-dind` still exists after DinD removal | Legacy flag cleanup is incomplete | Known unresolved cleanup item | `awf --help | grep enable-dind` | #1727 | | D4 | Enterprise LLM gateway needs an injected auth header | API proxy lacks a user extension point for that hop | Known unresolved proposal | No general probe; capture the required header flow in the report | #4849 | -| D5 | gVisor install step exits with `HTTP 404` / download failure; `runsc` binary not found; AWF exits with `runtime 'gvisor' is not available` or compose up fails immediately after `--container-runtime gvisor` | The AWF-compiler-generated gVisor install step (or smoke-test lock files) hardcodes a specific gVisor release tag (e.g. `20250623.0`); Google removes old releases from `storage.googleapis.com`, so the download returns 404 | Update gVisor lock files to the latest pinned release (`20250707.0` or newer); upgrade to the AWF version after PR github/gh-aw-firewall#6143 | `curl -sI https://storage.googleapis.com/gvisor/releases/release/20250623.0/x86_64/runsc` — HTTP 404 confirms a stale pin | github/gh-aw-firewall#6143 | +| D5 | gVisor install step exits with `HTTP 404` / download failure; `runsc` binary not found; AWF exits with `runtime 'gvisor' is not available` or compose up fails immediately after `--container-runtime gvisor` | The `gh-aw`-compiler-generated gVisor install step (or smoke-test lock files) pins a specific gVisor release tag (e.g. `20250623.0`); if that artifact is no longer available from `storage.googleapis.com`, the download returns 404 | Manually update the affected generated `.lock.yml` install step to a currently available release (for example, `20250707.0`), or upgrade to a `gh-aw` release containing the corresponding `DefaultGVisorVersion` update and recompile. PR github/gh-aw-firewall#6143 only patched this repository's four smoke-test lock files; it did not add an AWF configuration option or release an AWF fix. | `ARCH=$(uname -m); curl -sI https://storage.googleapis.com/gvisor/releases/release/20250623.0/${ARCH}/runsc` — HTTP 404 confirms the pinned artifact is unavailable; replace the tag with an available release and retry | github/gh-aw-firewall#6143 | ## Error-string quick lookup From 5fa46092b907f36d9d7f0f433b3136b938f44356 Mon Sep 17 00:00:00 2001 From: Landon Cox Date: Sun, 12 Jul 2026 18:38:34 -0700 Subject: [PATCH 4/4] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/shared/self-hosted-failure-modes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/shared/self-hosted-failure-modes.md b/.github/workflows/shared/self-hosted-failure-modes.md index 0fb88b44a..37cb2244a 100644 --- a/.github/workflows/shared/self-hosted-failure-modes.md +++ b/.github/workflows/shared/self-hosted-failure-modes.md @@ -72,7 +72,7 @@ Establish these facts before matching a failure mode: | D2 | cli-proxy fails on IPv6-enabled runners | The tunnel was bound only to `127.0.0.1` | Fixed by dual-stack binding | Check `ss -tlnp` inside `awf-cli-proxy` | #4626 | | D3 | `--enable-dind` still exists after DinD removal | Legacy flag cleanup is incomplete | Known unresolved cleanup item | `awf --help | grep enable-dind` | #1727 | | D4 | Enterprise LLM gateway needs an injected auth header | API proxy lacks a user extension point for that hop | Known unresolved proposal | No general probe; capture the required header flow in the report | #4849 | -| D5 | gVisor install step exits with `HTTP 404` / download failure; `runsc` binary not found; AWF exits with `runtime 'gvisor' is not available` or compose up fails immediately after `--container-runtime gvisor` | The AWF-compiler-generated gVisor install step (or smoke-test lock files) hardcodes a specific gVisor release tag (e.g. `20250623.0`); Google removes old releases from `storage.googleapis.com`, so the download returns 404 | Update gVisor lock files to the latest pinned release (`20250707.0` or newer): in your AWF config set `gvisor.releaseTag` to the newest valid tag, or upgrade to the AWF version after PR github/gh-aw-firewall#6143 which bumped all smoke-test lock files | `curl -sI https://storage.googleapis.com/gvisor/releases/release/20250623.0/x86_64/runsc` — HTTP 404 confirms a stale pin; replace tag with `20250707.0` and retry | github/gh-aw-firewall#6143 | +| D5 | gVisor install step exits with `HTTP 404` / download failure; `runsc` binary not found; AWF exits with `runtime 'gvisor' is not available` or compose up fails immediately after `--container-runtime gvisor` | The `gh-aw`-compiler-generated gVisor install step (or smoke-test lock files) pins a specific gVisor release tag (e.g. `20250623.0`); if that artifact is no longer available from `storage.googleapis.com`, the download returns 404 | Manually update the affected generated `.lock.yml` install step to a currently available release (for example, `20250707.0`), or upgrade to a `gh-aw` release containing the corresponding `DefaultGVisorVersion` update and recompile. PR github/gh-aw-firewall#6143 only patched this repository's four smoke-test lock files; it did not add an AWF configuration option or release an AWF fix. | `ARCH=$(uname -m); curl -sI https://storage.googleapis.com/gvisor/releases/release/20250623.0/${ARCH}/runsc` — HTTP 404 confirms the pinned artifact is unavailable; replace the tag with an available release and retry | github/gh-aw-firewall#6143 | ## Error-string quick lookup