fix: fix awf-runner timeout detection and no-docker test timeouts

[Copilot]

The docker command should not be available test in no-docker.test.ts was silently reporting success with empty stdout when the AWF process timed out during the initial Docker image build.

Root cause

Two bugs combined to produce a misleading failure:

1. Execa's reject: false + timeout returns instead of throws. When a timeout fires with reject: false, execa resolves with { timedOut: true, exitCode: undefined } rather than throwing. The runner only checked error.timedOut in its catch block, so a timed-out result fell through to exitCode = undefined ?? 0 = 0 → success: true, stdout: "".

2. 30s timeout too short for buildLocal: true first run. The first test in no-docker.test.ts bears the full Docker image build cost (~40–60s). Subsequent tests reuse cached layers and complete in ~28s.

Changes

• tests/fixtures/awf-runner.ts — Added a result.timedOut check after the try-catch in both run() and runWithSudo(), so execa's return-on-timeout path correctly surfaces { success: false, timedOut: true, exitCode: -1 }:

// With reject: false, execa returns instead of throwing on timeout.
if (result.timedOut) {
  return { exitCode: -1, stdout: result.stdout || '', stderr: result.stderr || '',
           success: false, timedOut: true, workDir: ... };
}

• tests/integration/no-docker.test.ts — Increased all timeout values from 30000 to 120000 to match the Jest test timeout, giving enough headroom for an initial image build.

Original prompt

Fix the failing GitHub Actions workflow Container & Ops Tests
Analyze the workflow logs, identify the root cause of the failure, and implement a fix.
Job ID: 67347423002
Job URL: https://github.com/github/gh-aw-firewall/actions/runs/23178913128/job/67347423002

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[Copilot]

Pull request overview

This PR fixes a misleading “success” outcome in the test runner when an execa process times out with reject: false, and updates integration test timeouts to accommodate initial local image builds during buildLocal: true runs.

Changes:

• Update AwfRunner.run() and AwfRunner.runWithSudo() to detect result.timedOut in addition to error.timedOut, returning a consistent timeout AwfResult.
• Increase no-docker integration test runner timeouts from 30s to 120s to avoid first-run build flakiness.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
tests/fixtures/awf-runner.ts	Properly detects the “return-on-timeout” execa behavior when reject: false, preventing false-positive successes on timeout.
tests/integration/no-docker.test.ts	Aligns test execution timeouts with expected --build-local first-run build duration to prevent premature timeouts.

Comments suppressed due to low confidence (1)

tests/fixtures/awf-runner.ts:409

• Same as run(): this return-on-timeout branch includes workDir, but the thrown-timeout catch branch above returns no workDir. It would be helpful to populate workDir from error.stderr there too so callers can still inspect Squid logs when a command times out.

    // With reject: false, execa returns instead of throwing on timeout.
    // Detect this case and return a proper timeout result.
    if (result.timedOut) {
      return {
        exitCode: -1,

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.