fix: speed up firewall shutdown by ~10s by Mossaka · Pull Request #1150 · github/gh-aw-firewall

Mossaka · 2026-03-05T18:24:11Z

Summary

Fixes #1103. The awf-api-proxy container takes ~10s to stop because its Dockerfile uses shell form CMD, making /bin/sh PID 1 instead of Node.js. The shell doesn't forward SIGTERM, so Docker waits its 10s grace period before SIGKILL.

Fix root cause: Change api-proxy Dockerfile from shell form to exec form so Node.js is PID 1 and handles SIGTERM directly
Add --skip-cleanup flag: Skip all cleanup (containers, iptables, work dir) in CI where the runner terminates anyway, saving additional ~10s

Test plan

npm run build compiles successfully
npm test — all 821 tests pass
npm run lint — 0 errors
Local test: sudo awf --build-local --allow-domains github.com -- curl https://api.github.com — verify fast shutdown
Local test: sudo awf --skip-cleanup --build-local --allow-domains github.com -- curl https://api.github.com — verify no cleanup happens

🤖 Generated with Claude Code

The api-proxy container used shell form CMD, making /bin/sh PID 1 instead of Node.js. The shell doesn't forward SIGTERM, forcing Docker to wait its 10s grace period before SIGKILL. Switch to exec form so Node.js handles SIGTERM directly. Also add --skip-cleanup flag to skip all cleanup in CI environments where the runner terminates anyway, saving additional shutdown time. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-03-05T18:25:12Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	82.03%	82.06%	📈 +0.03%
Statements	82.01%	82.03%	📈 +0.02%
Functions	82.50%	82.50%	➡️ +0.00%
Branches	74.20%	74.15%	📉 -0.05%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/cli.ts`	46.6% → 46.3% (-0.36%)	47.0% → 46.7% (-0.36%)
`src/docker-manager.ts`	83.1% → 83.7% (+0.56%)	82.4% → 83.0% (+0.54%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-03-05T18:28:50Z

Node.js Build Test Results ✅

Project	Install	Tests	Status
clsx	✅	PASS	PASS
execa	✅	PASS	PASS
p-limit	✅	PASS	PASS

Overall: PASS

Generated by Build Test Node.js for issue #1150

github-actions · 2026-03-05T18:28:52Z

Bun Build Test Results

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: ✅ PASS

All tests passed with Bun v1.3.10.

Generated by Build Test Bun for issue #1150

github-actions · 2026-03-05T18:28:59Z

Smoke Test Results

✅ GitHub MCP: #1003 chore(deps): bump the all-npm-dependencies group | #1078 fix: add explicit execute directive to smoke-codex
✅ Playwright: GitHub page title verified ("GitHub · Change is constant...")
✅ File Write: /tmp/gh-aw/agent/smoke-test-claude-22730613836.txt created
✅ Bash: File content verified

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude for issue #1150

github-actions · 2026-03-05T18:29:07Z

🦀 Rust Build Test Results

Project	Build	Tests	Status
fd	✅	1/1	PASS
zoxide	✅	1/1	PASS

Overall: ✅ PASS

Generated by Build Test Rust for issue #1150

github-actions · 2026-03-05T18:29:09Z

🦕 Deno Build Test Results

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: ✅ PASS

Test output details

oak:

running 1 test from ./test.ts
oak test ... ok (0ms)
ok | 1 passed | 0 failed (2ms)
```

**std:**
```
running 1 test from ./test.ts
std test ... ok (0ms)
ok | 1 passed | 0 failed (2ms)

Generated by Build Test Deno for issue #1150

github-actions · 2026-03-05T18:29:10Z

Smoke test results (run 22730613841)

✅ GitHub MCP — Last 2 merged PRs: #1078 fix: add explicit execute directive to smoke-codex to prevent noop, #1069 fix(deps): resolve high-severity rollup vulnerability in docs-site
✅ Playwright — github.com title contains "GitHub"
✅ File write — /tmp/gh-aw/agent/smoke-test-copilot-22730613841.txt created and verified
✅ Bash — cat confirmed file content

Overall: PASS | PR by @Mossaka, no assignees

📰 BREAKING: Report filed by Smoke Copilot for issue #1150

github-actions · 2026-03-05T18:29:48Z

.NET Build Test Results

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS

Run output

hello-world: Hello, World!

json-parse:

{
  "Name": "AWF Test",
  "Version": 1,
  "Success": true
}
Name: AWF Test, Success: True

Generated by Build Test .NET for issue #1150

github-actions · 2026-03-05T18:29:52Z

Merged PRs: fix: add explicit execute directive to smoke-codex to prevent noop | fix(deps): resolve high-severity rollup vulnerability in docs-site
GitHub MCP last-2 merged PRs: ✅
safeinputs-gh pr list: ✅
Playwright title contains GitHub: ✅
Tavily search: ❌ (tool unavailable)
File write: ✅
Cat verify: ✅
Discussion comment: ✅
Build npm ci && npm run build: ✅
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1150

github-actions · 2026-03-05T18:29:59Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.12	Python 3.12.3	❌ NO
Node.js	v24.14.0	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: FAILED — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot for issue #1150

github-actions · 2026-03-05T18:31:07Z

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS 🎉

Generated by Build Test C++ for issue #1150

github-actions · 2026-03-05T18:31:13Z

Go Build Test Results

Project	Download	Tests	Status
color	✅	PASS	✅ PASS
env	✅	PASS	✅ PASS
uuid	✅	PASS	✅ PASS

Overall: ✅ PASS

Generated by Build Test Go for issue #1150

github-actions · 2026-03-05T18:31:49Z

Java Build Test Results ☕

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: PASS 🎉

Both Java projects compiled and all tests passed successfully through the AWF firewall proxy.

Generated by Build Test Java for issue #1150

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings March 5, 2026 18:24

github-actions bot added build-test-node build-test-bun labels Mar 5, 2026

github-actions bot added the smoke-claude label Mar 5, 2026

github-actions bot added the build-test-rust label Mar 5, 2026

github-actions bot added build-test-deno smoke-copilot build-test-dotnet labels Mar 5, 2026

github-actions bot added the build-test-cpp label Mar 5, 2026

github-actions bot mentioned this pull request Mar 5, 2026

[agentics] No-Op Runs #1086

Open

github-actions bot added the build-test-go label Mar 5, 2026

github-actions bot added the build-test-java label Mar 5, 2026

Copilot AI reviewed Mar 5, 2026

View reviewed changes

Conversation

Mossaka commented Mar 5, 2026

Summary

Test plan

Uh oh!

github-actions bot commented Mar 5, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions bot commented Mar 5, 2026

Node.js Build Test Results ✅

Uh oh!

github-actions bot commented Mar 5, 2026

Bun Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

🦀 Rust Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

🦕 Deno Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

Uh oh!

github-actions bot commented Mar 5, 2026

.NET Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

Uh oh!

github-actions bot commented Mar 5, 2026

Chroot Version Comparison Results

Uh oh!

github-actions bot commented Mar 5, 2026

C++ Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

Go Build Test Results

Uh oh!

github-actions bot commented Mar 5, 2026

Java Build Test Results ☕

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants