Add MCP-focused integration coverage and CI example for GitHub MCP server

[Copilot]

The firewall needed integration proof that MCP-style workloads (e.g., GitHub MCP server) keep GitHub traffic allowed while blocking other egress, using the GitHub Actions token for auth.

• Integration tests
  • Added tests/integration/mcp-github.test.ts to verify allowed GitHub API access with token and blocked non-GitHub domains, including Squid log assertions.
  • Added a check that the actual ghcr.io/github/github-mcp-server:v0.19.0 container can start inside AWF under the allowlist.
• Examples
  • Added examples/github-mcp-smoke.sh to run a Dockerized GitHub API call through AWF, start the real GitHub MCP server container, and demonstrate blocking of unrelated domains; documented in examples/README.md.
• CI
  • Extended test-examples workflow to pre-pull the MCP server image and execute the new smoke example with ${{ github.token }}.
  • Added test-mcp-github job to test-integration workflow running the new suite with the Actions token and shared test filename variable, pre-pulling both curl and MCP images.

Example (from new test):

const result = await runner.runWithSudo(
  'docker run --rm -e GITHUB_TOKEN curlimages/curl:latest sh -c \'curl -fsS -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/rate_limit\'',
  { allowDomains: ['api.github.com','github.com','objects.githubusercontent.com','ghcr.io'] }
);
expect(result).toSucceed();

Original prompt

Add a few integration tests, examples, and CIs to test using AWF to restrict outbound network for MCP servers like the GitHub MCP server. The GitHub MCP server could be tested using GitHub Action generated token.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Mossaka]

@copilot address the comment

[Mossaka]

wait you are not actually running the GitHub MCP Server. Please run the server inside the firewall and test it: https://github.com/github/github-mcp-server

[Copilot]

Implemented a new AWF-covered path that actually starts the GitHub MCP server container (ghcr.io/github/github-mcp-server:v0.19.0) in both the integration test and the example smoke script; CI now pre-pulls the image and runs this server-start check. Commit: a475580

[github-actions]

Test Coverage Report

Metric	Coverage	Covered/Total
Lines	77.12%	1281/1661
Statements	77.17%	1312/1700
Functions	77.04%	141/183
Branches	69.29%	431/622

Coverage Thresholds

The project has the following coverage thresholds configured:

• Lines: 38%
• Statements: 38%
• Functions: 35%
• Branches: 30%

---

Coverage report generated by `npm run test:coverage`