test: add IPv6 integration tests

[Copilot]

The test suite lacked integration tests for IPv6 functionality, leaving gaps in coverage for IPv6 DNS filtering and ip6tables configuration.

Changes

• tests/fixtures/awf-runner.ts: Added dnsServers option to AwfOptions interface for both run() and runWithSudo() methods
• tests/integration/ipv6.test.ts: New test file with 12 test cases covering:
  • IPv6 DNS server configuration (pure IPv6, mixed IPv4/IPv6)
  • IPv6 traffic blocking behavior
  • ip6tables availability detection and chain cleanup
  • IPv4/IPv6 parity verification
  • Edge cases (link-local addresses, empty IPv6 DNS list)
• .github/workflows/test-integration.yml: Added test-ipv6 job

Usage

const result = await runner.runWithSudo('curl https://example.com', {
  allowDomains: ['example.com'],
  dnsServers: ['8.8.8.8', '2001:4860:4860::8888'],
});

Tests detect IPv6/ip6tables availability at runtime and skip appropriately when unavailable.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 8.8.4.4
  • Triggering command: REDACTED, pid is -1 (packet block)
• 8.8.8.8
  • Triggering command: REDACTED, pid is -1 (packet block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[Testing] Missing IPv6 integration tests</issue_title>
<issue_description>## Priority
Low

Description

The test suite lacks integration tests for IPv6 functionality, which leaves a gap in test coverage for IPv6 filtering and DNS configuration.

Impact

• Severity: Low
• Risk: IPv6 filtering bugs may go undetected
• Coverage Gap: IPv6 scenarios not validated in CI/CD

Proposed Solution

Add integration tests for:

1. IPv6 DNS filtering (default: Google DNS IPv6 addresses)
2. IPv6 traffic blocking when ip6tables is unavailable
3. IPv6 sysctl configuration verification
4. IPv6 address validation in domain patterns

Test Scenarios

# Test IPv6 DNS filtering
awf --dns-servers 2001:4860:4860::8888,2001:4860:4860::8844 'curl https://example.com'

# Test IPv6 traffic blocking
awf --allow-domains example.com 'curl -6 https://ipv6.google.com'

Effort Estimate

~3 hours

References

• Source: Daily Security Review Discussion [Security Review] Daily Security Review - January 16, 2026 #228
• Related: IPv6 filtering gaps issue</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes [Testing] Missing IPv6 integration tests #257

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	77.19%	77.19%	➡️ +0.00%
Statements	77.27%	77.27%	➡️ +0.00%
Functions	77.17%	77.17%	➡️ +0.00%
Branches	69.76%	69.76%	➡️ +0.00%

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

[github-actions]

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

Smoke Test Results

Last 2 Merged PRs:

• ci: pin GitHub Actions to commit SHAs for supply chain security #266: ci: pin GitHub Actions to commit SHAs for supply chain security
• chore: delete existing firewall tests and migrate smoke tests #229: chore: delete existing firewall tests and migrate smoke tests

Test Results:

• ✅ GitHub MCP: Retrieved PR titles successfully
• ❌ Playwright: Browser download blocked by firewall (azureedge.net not whitelisted)
• ✅ File Creation: Created /tmp/gh-aw/agent/smoke-test-copilot-21092112397.txt
• ✅ Bash Tools: File verification passed

Overall Status: FAIL (Playwright blocked)

cc: @Mossaka

AI generated by Smoke Copilot

[github-actions]

Smoke Test Results (Claude)

Last 2 merged PRs: (retrieving...)

• ✅ GitHub MCP: Connected
• ✅ Playwright: Page title contains "GitHub"
• ✅ File Write: Test file created
• ✅ Bash: File verified

Status: PASS

AI generated by Smoke Claude

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

[github-actions]

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

[github-actions]

Smoke Test Results

PRs: #291 (remove smoke-codex), #246 (docs preview workflow)
✅ GitHub MCP
✅ Playwright (page title contains "GitHub")
✅ File write
✅ Bash tool

Status: PASS

AI generated by Smoke Claude

[github-actions]

Smoke Test Results

Last 2 Merged PRs:

• ci: add eslint, build workflows and dependabot configuration #261: ci: add eslint, build workflows and dependabot configuration
• feat: expand integration test coverage from 7 to 17 test files #251: feat: expand integration test coverage from 7 to 17 test files

Test Results:

• ✅ GitHub MCP - Retrieved PRs successfully
• ✅ File Writing - Created /tmp/gh-aw/agent/smoke-test-copilot-21092325400.txt
• ✅ Bash Tool - Verified file content
• ❌ Playwright - Missing system dependencies (libglib-2.0.so.0)

Status: FAIL (3/4 tests passed)

cc: @Mossaka (author/assignee)

AI generated by Smoke Copilot