fix(squid): increase healthcheck tolerance to prevent intermittent startup failures by lpcox · Pull Request #3936 · github/gh-aw-firewall

lpcox · 2026-05-27T15:00:11Z

Summary

Increases the Squid container healthcheck tolerance to prevent intermittent "container is unhealthy" failures on loaded runners.

Problem

The Squid healthcheck was configured with tight timing:

start_period: 2s, retries: 5, interval: 1s, timeout: 1s
Total window: ~7 seconds

On loaded ubuntu-24.04 runners, Squid initialization (chown preflight → base64 config decode → IPv6 check → Squid startup) can exceed this window, causing dependent containers to fail with dependency failed to start: container awf-squid is unhealthy.

Fix

Relaxed healthcheck parameters:

start_period: 5s (was 2s)
retries: 10 (was 5)
interval: 2s (was 1s)
timeout: 2s (was 1s)

Total window: ~25s. Happy-path startup still detected within 5-7s (first successful probe during start_period or first retry).

Fixes #3934

…artup failures The Squid container can fail its healthcheck on loaded runners when initialization (chown, base64 decode, IPv6 check, Squid startup) takes longer than the 7-second window. Increase start_period from 2s to 5s, retries from 5 to 10, and interval/timeout from 1s to 2s, giving Squid ~25s total to become healthy without meaningfully slowing the happy path. Fixes #3934 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-05-27T15:01:40Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	96.48%	96.53%	📈 +0.05%
Statements	96.35%	96.40%	📈 +0.05%
Functions	98.22%	98.22%	➡️ +0.00%
Branches	90.62%	90.66%	📈 +0.04%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/config-writer.ts`	89.3% → 90.9% (+1.65%)	89.3% → 90.9% (+1.65%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

This PR adjusts the Docker Compose Squid service healthcheck timing to reduce intermittent “container is unhealthy” startup failures on slower or heavily loaded runners, improving reliability for dependent services that wait on service_healthy.

Changes:

Increased Squid healthcheck start_period from 2s → 5s.
Relaxed probe parameters: interval 1s → 2s, timeout 1s → 2s, retries 5 → 10.

Show a summary per file

File	Description
`src/services/squid-service.ts`	Relaxes Squid container healthcheck parameters to provide a larger startup tolerance window.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 1/1 changed files
Comments generated: 1

    healthcheck: {
      test: ['CMD', 'nc', '-z', 'localhost', '3128'],
-      interval: '1s',
-      timeout: '1s',
-      retries: 5,
-      start_period: '2s',
+      interval: '2s',
+      timeout: '2s',
+      retries: 10,
+      start_period: '5s',


github-actions · 2026-05-27T15:03:13Z

Smoke Test: Claude Engine ✅

✅ GitHub API: 2 recent PR entries fetched
✅ GitHub check: playwright_check PASS
✅ File verify: smoke-test-claude-26519418580.txt exists

Result: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-05-27T15:04:10Z

Smoke Test: Gemini Engine Validation

GitHub MCP Testing: ❌ (Tools missing or unreachable)
GitHub.com Connectivity: ❌ (Status 000)
File Writing Testing: ✅
Bash Tool Testing: ✅

Overall status: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

lpcox · 2026-05-27T15:04:43Z

@copilot address the review feedback

Copilot · 2026-05-27T15:15:38Z

@copilot address the review feedback

Implemented in 1f7b8b9: added explicit assertions in src/services/squid-service.test.ts for Squid healthcheck test, interval, timeout, retries, and start_period so the tolerance settings are locked by unit tests.

github-actions · 2026-05-27T15:21:14Z

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Test	Result
GitHub MCP connectivity	✅ PR listed: "fix(test): update smoke-claude test to match v0.76.1 action pin"
GitHub.com HTTP connectivity	⚠️ Template var not expanded (pre-step data unavailable)
File write/read	⚠️ Template var not expanded (pre-step data unavailable)
BYOK inference (api-proxy → api.githubcopilot.com)	✅ Responding now

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

Author: @lpcox | Overall: PARTIAL (MCP + BYOK ✅; pre-step data not injected ⚠️)

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-05-27T15:21:57Z

🔥 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅
File write/read	✅ (`smoke-test-copilot-26520287286.txt` verified)
GitHub.com connectivity	✅ (MCP reachable)

PR: fix(squid): increase healthcheck tolerance to prevent intermittent startup failures
Author: @lpcox | Assignees: none

Overall: PASS ✅

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-05-27T15:23:40Z

Smoke Test Results — FAIL

Check	Result
Redis PING	❌ timeout (no response)
PostgreSQL pg_isready	❌ no response
PostgreSQL SELECT 1	❌ timeout (no response)

host.docker.internal is not reachable on ports 6379 or 5432. Service containers may not be running or network routing to the host is blocked.

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-05-27T15:23:57Z

fix(squid): increase healthcheck tolerance to prevent intermittent startup failures ✅
fix(test): update smoke-claude test to match v0.76.1 action pin ✅
Remove dead cleanupFirewallNetwork export from host iptables network module ✅
GitHub title check ✅
Smoke file check ✅
Discussion check ✅
Build check ❌
Overall: FAIL

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-05-27T15:24:43Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #3936 · sonnet46 1M · ◷

github-actions · 2026-05-27T15:24:57Z

Chroot Runtime Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌ NO
Node.js	v24.16.0	v22.22.3	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Overall: FAILED — Python and Node.js versions differ between host and chroot.

Tested by Smoke Chroot

Copilot AI review requested due to automatic review settings May 27, 2026 15:00

Copilot started reviewing on behalf of lpcox May 27, 2026 15:00 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread src/services/squid-service.ts

Comment on lines 74 to +79

healthcheck: {

test: ['CMD', 'nc', '-z', 'localhost', '3128'],

interval: '1s',

timeout: '1s',

retries: 5,

start_period: '2s',

interval: '2s',

timeout: '2s',

retries: 10,

start_period: '5s',

github-actions Bot added the smoke-claude label May 27, 2026

This comment has been minimized.

Sign in to view

github-actions Bot added the smoke-copilot label May 27, 2026

This comment has been minimized.

Sign in to view

Copilot started work on behalf of lpcox May 27, 2026 15:10 View session

test(squid): assert healthcheck timing config

1f7b8b9

Copilot finished work on behalf of lpcox May 27, 2026 15:16

github-actions Bot added the smoke-copilot-byok label May 27, 2026

github-actions Bot added the build-test label May 27, 2026

Conversation

lpcox commented May 27, 2026

Summary

Problem

Fix

Uh oh!

github-actions Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actions Bot commented May 27, 2026

Smoke Test: Claude Engine ✅

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

github-actions Bot commented May 27, 2026

Smoke Test: Gemini Engine Validation

Uh oh!

lpcox commented May 27, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

Copilot AI commented May 27, 2026

Uh oh!

github-actions Bot commented May 27, 2026

🔥 Smoke Test: Copilot BYOK (Offline) Mode

Uh oh!

github-actions Bot commented May 27, 2026

🔥 Smoke Test Results

Uh oh!

github-actions Bot commented May 27, 2026

Smoke Test Results — FAIL

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

github-actions Bot commented May 27, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented May 27, 2026

Chroot Runtime Version Comparison

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented May 27, 2026 •

edited

Loading