🩺 Runner Doctor UpdateRunner Doctor catalog update — B13 Squid ACL gap, B9 RHEL CA mount fix (2026-07-20–21 scan)

[github-actions]

Summary

• Scan window: 2026-07-20 – 2026-07-21 UTC
• Items reviewed: PRs Expose RHEL/Amazon Linux CA roots in chroot mode #6460, Auto-allow topology-attached container hostnames in Squid ACL #6473, Support COPILOT_MODEL=auto in AWF validation and api-proxy resolution #6474 (and issues RHEL/Amazon Linux system CA bundle remains unavailable in chroot after #5783 #6459, Support for copilot auto model #6463, firewall reports blocking awfmcpg #6467); previous runner-doctor issue docs: Runner Doctor catalog update — B10 entrypoint fix, B13/B14/D10 new entries (2026-07-17–20 scan) #6445 already covered the 2026-07-17–20 window
• Genuinely new lessons: 2

---

Proposed knowledge-base changes

File: .github/workflows/shared/self-hosted-failure-modes.md

1. Update B13 — add citation #6473 and extend the Fix/Probe columns

The existing B13 row covers TCP_DENIED for topology peers and the DIFC proxy host, citing fixes in #6189 (NO_PROXY for topology peers) and #6438 (NO_PROXY for difcProxyHost). PR #6473 closes a remaining gap: tools that respect HTTP(S)_PROXY but ignore NO_PROXY still routed through Squid, which blocked them because the topology hostname was not in the Squid ACL allowlist.

Replace the B13 Fix cell (currently ending ...fixed in github/gh-aw-firewall#6189 and github/gh-aw-firewall#6438) with:

Fixed in AWF (PR #6189, merged 2026-07-20): config.topologyAttach peer hostnames are now added to NO_PROXY/no_proxy. Fixed in AWF (PR #6438, merged 2026-07-20): config.difcProxyHost (stripped of any :port suffix) is also added to NO_PROXY. Fixed in AWF (PR #6473, merged 2026-07-21): Topology peer hostnames and difcProxyHost are also auto-added to the Squid ACL allowlist (via resolveAllowedDomains()) so that proxy-aware clients that honour HTTP(S)_PROXY but ignore NO_PROXY are still permitted by Squid. The gating mirrors buildProxyEnvironment(): only active when networkIsolation is true and the runtime is compose-based (runtimeUsesComposeAgent()); microVM backends (sbx) are excluded. Upgrade AWF to the version including #6473.

Extend the B13 Probe cell to add: Inspect Squid access.log for TCP_DENIED entries for topology peer or DIFC proxy host even after upgrading to AWF with #6189/#6438 — present on AWF missing #6473; confirm topology hostname appears in generated allowedDomains in compose YAML after #6473.

Extend the B13 Citations cell to add: github/gh-aw-firewall#6473

---

2. Update B9 — add citation #6460 (RHEL/Amazon Linux CA mount policy fix)

B9 currently cites only PR #5783 (bundle-staging fallback via copy_system_ca_bundle()). PR #6460 adds a complementary mount-policy fix: /etc/pki/ca-trust and /etc/pki/tls are now directly bind-mounted as chroot-visible /etc paths, so RHEL/Amazon Linux CA bundles are readable in-place without the staging fallback. The entrypoint CA detection is also extended to treat these paths as already-accessible when found inside the chroot.

Replace the B9 Fix cell (currently: **Fixed in AWF (PR github/gh-aw-firewall#5783)**...) with:

Fixed in AWF (PR #5783): copy_system_ca_bundle() in agent entrypoint detects the CA bundle from 5 candidate paths (Debian, RHEL, Fedora, macOS, Alpine), copies it to /tmp/awf-lib/system-ca-certificates.crt if not directly accessible, and sets SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE, GIT_SSL_CAINFO. Further fixed in AWF (PR #6460, merged 2026-07-21): /etc/pki/ca-trust and /etc/pki/tls are now included in the chroot mount policy, making RHEL/Amazon Linux CA paths directly accessible inside /host/etc/pki without requiring the staging fallback. Workaround (older AWF): copy /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem to a chroot-visible path and set those env vars.

Extend the B9 Citations cell to add: github/gh-aw-firewall#6460

---

File: .github/workflows/self-hosted-runner-doctor.md

No playbook or error-string lookup additions required — the B13 observable (TCP_DENIED for topology peer) is already present in the quick-lookup table; B9's error string (No CA certificates were loaded from the system) is already present. The updates are fix/citation extensions only.

---

Proposed portable agent changes

File: .github/agents/self-hosted-runner-doctor.md

Apply the same two edits described above to the embedded copy of the failure-mode catalog in the portable agent:

1. B13 Fix + Citations — add the Auto-allow topology-attached container hostnames in Squid ACL #6473 Squid ACL fix paragraph and add github/gh-aw-firewall#6473 to citations.
2. B9 Fix + Citations — extend the fix cell with the Expose RHEL/Amazon Linux CA roots in chroot mode #6460 mount-policy paragraph and add github/gh-aw-firewall#6460 to citations.

---

Source issues and PRs

Citation	Title	Link
#6473	Auto-allow topology-attached container hostnames in Squid ACL	#6473
#6467	firewall reports blocking awfmcpg (issue closed by #6473)	#6467
#6460	Expose RHEL/Amazon Linux CA roots in chroot mode	#6460

Generated by Runner Doctor Updater · 38.6 AIC · ⊞ 20.8K · ◷

• expires on Aug 20, 2026, 7:22 PM UTC