Add 172.30.0.1 to CodexDefaultDomains for AWF gateway access #13768

Mossaka · 2026-02-04T17:53:17Z

Summary

Fixes Smoke Codex failing due to MCP gateway access being blocked by AWF firewall
Adds 172.30.0.1 (AWF gateway IP) to CodexDefaultDomains in domains.go
Updates tests to reflect the new domain

Root Cause

The convert_gateway_config_codex.sh script resolves host.docker.internal to 172.30.0.1 for Rust DNS compatibility in Codex CLI. However, this IP was not in the allowed domains list for AWF firewall, causing all MCP requests to be blocked with 403 Forbidden errors.

Evidence from firewall logs:

▼ 30 requests | 6 allowed | 24 blocked | 4 unique domains
| Domain | Allowed | Denied |
|--------|---------|--------|
| 172.30.0.1 | 0 | 6 |  <-- MCP gateway blocked
| mcp | 0 | 6 |
| api.openai.com | 6 | 0 |

Test plan

Unit tests pass (go test ./pkg/workflow/... -run "Codex|Domain")
Smoke Codex workflow passes with the new domain allowlist

🤖 Generated with Claude Code

The convert_gateway_config_codex.sh script resolves host.docker.internal to 172.30.0.1 for Rust DNS compatibility, but this IP was not in the allowed domains list for AWF firewall, causing all MCP requests to be blocked with 403 Forbidden errors. This fix adds 172.30.0.1 to CodexDefaultDomains so Codex can access the MCP gateway through AWF's network firewall. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

github-actions · 2026-02-04T17:54:10Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-02-04T17:54:10Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-04T17:54:10Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-02-04T17:54:11Z

🎉 Yo ho ho! Changeset Generator found the treasure and completed successfully! ⚓💰

Copilot

Pull request overview

Updates Codex network allowlists to permit MCP gateway access when host.docker.internal resolves to the AWF gateway IP (172.30.0.1), preventing AWF firewall 403s in Codex workflows.

Changes:

Add 172.30.0.1 to CodexDefaultDomains.
Update unit tests to include/sort the new default domain.
Update the Smoke Codex locked workflow’s allowed domain list to include 172.30.0.1.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
`pkg/workflow/domains.go`	Adds `172.30.0.1` to Codex default domain allowlist used for firewall configuration.
`pkg/workflow/domains_test.go`	Updates Codex domain expectations and allowed-domain string assertions to include `172.30.0.1`.
`.github/workflows/smoke-codex.lock.yml`	Includes `172.30.0.1` in AWF `--allow-domains` and `GH_AW_ALLOWED_DOMAINS`; also changes the scheduled cron minute.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-04T17:57:12Z

.github/workflows/smoke-codex.lock.yml

  schedule:
-  - cron: "16 */12 * * *"
+  - cron: "31 */12 * * *"
  workflow_dispatch: null


The scheduled cron minute changed from "16 */12 * * *" to "31 */12 * * *" but the PR description focuses on the domain allowlist update. If this timing shift wasn’t intentional, consider reverting it to avoid an operational change/noise in the generated lockfile; if it is intentional, please call it out in the PR description (or ensure it’s coming from the source workflow manifest and not an accidental manual edit of the generated .lock.yml).

github-actions · 2026-02-04T17:57:13Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.52.0
jq	✅	1.7
yq	✅	4.50.1
curl	✅	8.5.0
gh	✅	2.86.0
node	✅	20.20.0
python3	✅	3.12.3
go	✅	1.24.12
java	⚠️	21.0.10-7 (in PATH but version check blocked)
dotnet	❌	present but cannot execute (bash compatibility issue)

Result: 10/12 tools fully available, 1 partial (java), 1 unavailable (dotnet) ⚠️

Notes:

Java is installed and in PATH but java -version command is intercepted by bash
Dotnet binary exists but cannot be executed due to shell environment issue ("cannot execute dotnet when renamed to bash")
All core development tools (bash, git, jq, yq, curl, gh, node, python3, go) are fully functional

AI generated by Agent Container Smoke Test

github-actions · 2026-02-04T17:58:17Z

✅ Smoke Test PASS (Run 21682347574)

PRs Tested:

Update docs to align with AWF chroot mode #13758: Update docs to align with AWF chroot mode
Use AWF --enable-chroot mode and remove unnecessary --mount and --env flags #13576: Use AWF --enable-chroot mode and remove unnecessary --mount and --env flags

Results:

✅ GitHub MCP
✅ Safe Inputs GH CLI
✅ Serena MCP
✅ Playwright
✅ File Writing/Bash
✅ Discussion Interaction
✅ Build gh-aw
✅ Workflow Dispatch

Overall: PASS

cc: @Mossaka

AI generated by Smoke Copilot

github-actions · 2026-02-04T17:58:30Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

github-actions · 2026-02-04T18:04:02Z

💀 Blimey! Changeset Generator failed and walked the plank! No treasure today, matey! ☠️

github-actions · 2026-02-04T18:04:02Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-02-04T18:04:08Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

github-actions · 2026-02-04T18:04:08Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-04T18:06:33Z

Agent Container Tool Check

Tool	Status	Version
bash	✅	5.2.21(1)-release
sh	✅	available
git	✅	2.52.0
jq	✅	jq-1.7
yq	✅	v4.50.1
curl	✅	8.x
gh	✅	2.86.0
node	✅	v20.20.0
python3	✅	3.x
go	✅	go1.24.12
java	✅	21.x
dotnet	❌	not found

Result: 11/12 tools available ❌

Status: FAIL - .NET runtime (dotnet) is not available in the container environment.

All essential development tools (bash, git, node, python, go, java) are present. Only dotnet is missing.

AI generated by Agent Container Smoke Test

github-actions · 2026-02-04T18:09:01Z

Smoke Test Results ✅

cc @Mossaka

AI generated by Smoke Copilot

github-actions · 2026-02-04T18:09:17Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

Copilot AI review requested due to automatic review settings February 4, 2026 17:53

Mossaka added the smoke label Feb 4, 2026

Copilot started reviewing on behalf of Mossaka February 4, 2026 17:53 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

github-actions bot mentioned this pull request Feb 4, 2026

Smoke Test: Copilot - 21682347574 #13770

Closed

github-actions bot added smoke-copilot and removed smoke labels Feb 4, 2026

github-actions bot mentioned this pull request Feb 4, 2026

Smoke Test: Claude - 21682347560 #13771

Closed

Mossaka added the smoke label Feb 4, 2026

github-actions bot mentioned this pull request Feb 4, 2026

Smoke Test: Copilot - 21682660379 #13774

Closed

github-actions bot removed the smoke label Feb 4, 2026

Merge origin/main and resolve conflict (keep 172.30.0.1 + --skip-pull)

810e3da

Mossaka merged commit f0ac96e into main Feb 4, 2026
49 of 50 checks passed

Mossaka deleted the fix/codex-awf-gateway-domain branch February 4, 2026 18:12

Copilot AI mentioned this pull request Feb 4, 2026

Merge main and recompile workflows after test-yaml-import relocation #13780

Closed

Add 172.30.0.1 to CodexDefaultDomains for AWF gateway access #13768

Add 172.30.0.1 to CodexDefaultDomains for AWF gateway access #13768

Conversation

Mossaka commented Feb 4, 2026

Summary

Root Cause

Test plan

Uh oh!

github-actions bot commented Feb 4, 2026

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 4, 2026

Agent Container Tool Check

Uh oh!

github-actions bot commented Feb 4, 2026

Uh oh!

github-actions bot commented Feb 4, 2026

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 4, 2026

Agent Container Tool Check

Uh oh!

github-actions bot commented Feb 4, 2026

Smoke Test Results ✅

Uh oh!

github-actions bot commented Feb 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions bot commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading

github-actions bot commented Feb 4, 2026 •

edited

Loading