[lpcox]

Summary

Move Smoke Services' cold local image builds out of the agent's ten-minute execution budget into a separately bounded 35-minute setup step. Reuse the existing Smoke Copilot preparation mechanism through one shared script.

Setup builds and inspects Squid, agent and API-proxy images from the checked-out source, matching Compose's UID/GID build arguments. Execution selects those run/attempt-specific local images with --skip-pull, without rebuilding or falling back to released AWF images. Preparation fails closed before publishing the image tag. Services' ten-minute execution timeout, firewall, service checks, safe outputs and release-mode workflows are unchanged.

The failing Smoke Services job timed out while Squid was still compiling; the agent had not reached the Redis/PostgreSQL checks.

Validation

• Build and type-check passed; six focused Jest suites / 155 tests passed.
• Stubbed-Docker coverage verifies exact Compose contexts and UID/GID, failure propagation for every build/inspect, image-selection precedence, setup ordering, unchanged execution timeouts, release-mode preservation and idempotent lock postprocessing.
• Shared shell script passed shellcheck.
• Both normal locks regenerated with matching gh-aw v1.0.1 and postprocessed. Normal compilation/validation succeeds with the existing dispatch-concurrency warnings. Repeated postprocessing leaves final locks unchanged.
• Native actionlint has no added findings: the same eight baseline schema compatibility findings remain (queue, workflow_ref, copilot-requests).
• gh aw compile --dry-run rejects existing authored host steps/post-steps; no diagnostic lock was emitted. Optional scanners were not run by dry-run.

Hosted Linux image-build timing and live service connectivity are not reverified on this macOS host. No workflow was dispatched.

Security review

Read-only authored-source and final-lock review: PASS, no confirmed vulnerabilities; credentials, permissions, firewall and safe-output controls preserved. This does not establish hosted execution or authorize dispatch.

Markdown source	Change	Security impact
smoke-services.md:73–75	Add bounded setup call before agent execution, replacing the cold build inside its budget.	Same source-built images and UID/GID; fail-closed run-specific selection. Permissions, recipients, prompts, sandbox and outputs unchanged.
smoke-copilot.md:65–68	Replace identical inline build commands with the shared helper; retain the 35-minute bound.	No new credential flow, external recipient or persistence; existing controls unchanged.

[Copilot]

🟡 Changes recommended

Both smoke workflows invoke a workspace-relative helper after checking out PR heads that may lack it, causing runs to fail before image preparation or service checks.

1 open issue

• Preserve helper before checking out the PR head · New

What changed in this PR

This PR moves Smoke Services’ cold local image builds outside its ten-minute agent execution budget and shares image preparation logic with Smoke Copilot.

Changes:

• Adds a shared script to build and inspect run-specific Squid, agent, and API-proxy images.
• Adds a separate 35-minute Services setup step and selects prepared images with --skip-pull.
• Updates generated workflows and expands regression coverage for preparation failures, ordering, and image selection.

File	Description
scripts/​ci/​smoke-image-preparation.test.ts	Extends preparation checks to Services and all build/inspect failures.
scripts/​ci/​build-smoke-images.sh	Centralizes local image builds, inspection, and tag publication.
scripts/​ci/​apply-general-workflow-patches.ts	Extends prepared-image handling to Smoke Services.
.github/​workflows/​smoke-services.md	Adds bounded image preparation before agent execution.
.github/​workflows/​smoke-services.lock.yml	Adds setup and switches execution to prepared images.
.github/​workflows/​smoke-copilot.md	Replaces inline preparation with the shared script.
.github/​workflows/​smoke-copilot.lock.yml	Reflects the shared-script invocation in the generated workflow.

_{Review effort: Max}

[lpcox]

@copilot address review feedback

[github-actions]

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.62%	93.63%	➡️ +0.01%
Statements	92.11%	92.12%	📈 +0.01%
Functions	91.22%	91.22%	➡️ +0.00%
Branches	86.19%	86.20%	📈 +0.01%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
src/nvx/one-shot-adapter.ts	82.9% → 83.4% (+0.56%)	80.2% → 80.7% (+0.52%)

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

✅ Copilot review passed with no inline comments.

@lpcox Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.