[Christof Marti (chrmarti)]

Follow-up to #345225, which added the WSL Kerberos proxy smoke tests without running them in CI. CI and smoke test changes only; nothing here is needed on release/1.145.

Changes

• Pinned server. test/smoke/wslDevContainer.ps1 pins Insiders 67710841ad0 (instead of 0469440342), whose Agent Host has the client proxy, Kerberos and certificate support. It installs krb5-kdc, krb5-admin-server, squid-openssl and openssl into the CI distribution, with a policy-rc.d that keeps the packages from starting their services. The WSL Dev Container suite uses the same server.
• Which suites run where. A packaged server only accepts a packaged client of its own commit, so the editor window suite cannot run against the pinned server from source or from another build:
  • GitHub (pr-win32-test.yml, smoke shard 1): after the main Electron smoke run, the runner runs the Agents Window suite (-Suites AgentsWindow).
  • Azure (product-build-win32-test.yml, Windows x64 Smoke job): a new smoke-wsl-kerberos-proxy checkpoint runs both suites with the packaged client. The editor window suite uses the Linux server of the same run's Linux x64 compile job: the job waits for compilation_linux_x64 (normally already published before the Windows smoke job starts), downloads only builds.tar.gz, and wslDevContainer.ps1 -Operation AddServer extracts the server into the distribution. Runs without a Linux x64 product build (CI builds, Windows-only builds) run only the Agents Window suite.
  • The WSL setup now runs while either smoke-electron or smoke-wsl-kerberos-proxy still has to pass, and is cleaned up after both. The new ID is added to the Windows x64 Smoke jobs of all three pipelines and to the checkpoint lists and template tests.
• Runner. -Suites All|AgentsWindow|EditorWindow selects the suites. The runner moves an earlier .build/logs/smoke-tests-electron aside during its run and files its own smoke logs under .build/logs/agents-window-wsl-kerberos-proxy, so the main smoke run's logs survive. Likewise, it keeps the main run's JUnit report and files its own as *-desktop-smoke-tests-wsl-kerberos-proxy-results.xml, so PublishTestResults gets both.
• Fixture. The editor window suite fails early with a clear message when a packaged client and the server have different commits, instead of timing out.

How to test

Locally, on Windows with an elevated PowerShell, emulate the CI job: run test\smoke\wslDevContainer.ps1 with GITHUB_WORKSPACE, GITHUB_RUN_ID, GITHUB_RUN_ATTEMPT and GITHUB_OUTPUT set, then test\smoke\scripts\run-agents-window-wsl-kerberos-proxy.ps1 -Distribution <distro> -WslServerPath /opt/vscode-smoke-server, with --build <Insiders 67710841ad0 client> for both suites or -Suites AgentsWindow from source, and clean up with -Operation Cleanup.

Validation

Rebased from release/1.145 onto main; the only conflict was the README's npm commands (now pnpm). The runner already calls pnpm.cmd on main.

On main:

• node --test build/lib/test/testCheckpointTemplates.test.ts build/lib/test/testCheckpoint.test.ts: 29 passing, 1 failing. The failure, only the product test steps use checkpoints, compares \ and / path separators and fails on Windows without this change too.
• pnpm run typecheck in build: passed. pnpm run compile in test/smoke: passed. pnpm run eslint on the changed TypeScript files: passed.
• The JUnit report handling, simulated with an earlier report, a rerun and a run without a report: the main and browser reports survive and the Kerberos run's report gets its own name.
• Rebased again onto main (63475797ee6) after test: bound and retry apt in the WSL smoke setup #345598 bounded and retried apt in wslDevContainer.ps1: the Kerberos and Squid packages join $aptPackages, and policy-rc.d now wraps only the final install.
• GitHub (63475797ee6): all checks passed. In Electron smoke shard 1, the WSL setup installed the packages with policy-rc.d denying their services, and the Kerberos step passed the Agents Window suite ("1 passing").
• Azure build 491928 (63475797ee6, Windows x64 and Linux x64, tests on, no publishing): all 23 jobs passed. In the Windows x64 Smoke job, the Kerberos step passed both suites with the packaged client and the Linux x64 server of the same run, and "Publish Tests Results" published two test runs: the main Electron smoke run (91 results) and the Kerberos run (2). The earlier build 491824 (90bf37b2dab) passed the same way.
  Before the rebase, on release/1.145 with the same scripts (npm instead of pnpm):
• Local CI emulation: wslDevContainer.ps1 provisioned the Ubuntu 22.04 distribution with the new packages and pinned server. From source, the Agents Window suite passed; the editor window suite failed with "Unauthorized client refused", which led to -Suites AgentsWindow for GitHub. With the Insiders 67710841ad0 client (--build), both suites passed, and the script verified the PAC fetch, the Kerberos-authenticated tunnels through Squid and the KDC tickets issued to Windows. Cleanup removed the distribution and the Windows configuration.
• GitHub: the Kerberos step of Electron smoke shard 1 passed the Agents Window suite ("1 passing"). Earlier runs found the missing checkpoint variables in testCheckpoint.test.ts and that the CI image's JDK klist shadows Windows' klist.exe, so the runner now calls the latter by path.
• Azure build 491806 (Windows x64 and Linux x64, tests on, no publishing): all 23 jobs passed. In the Windows x64 Smoke job, the Linux x64 server steps took about 35 s together (wait, download, AddServer), and the Kerberos step passed both suites with the packaged client and the Linux x64 server of the same run. Copilot's review then found that this run replaced the main smoke run's JUnit report, which the last commit fixes.

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Setup pnpm

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

[Copilot]

🟡 Changes recommended

When both smoke runs execute, the second overwrites the main Electron run’s JUnit report, causing PublishTestResults to lose the main run’s results.

1 open issue

• Smoke run overwrites the main Electron JUnit report · New

What changed in this PR

This PR brings the existing WSL Kerberos proxy smoke suites into CI, covering Agent Host use of the Windows client’s proxy, Kerberos tickets, and certificates.

Changes:

• Provisions the required WSL packages and supports extracting a matching Linux server from product-build artifacts.
• Runs the Agents Window suite in GitHub CI and both suites in eligible Azure product builds, with checkpoint support.
• Adds suite selection, preserves earlier smoke logs, and reports client/server commit mismatches early.

File	Description
test/​smoke/​wslDevContainer.ps1	Updates the pinned server, installs proxy-test dependencies, and adds server extraction.
test/​smoke/​src/​areas/​agentsWindow/​remoteDevContainerFixtures.ts	Detects packaged client/server commit mismatches.
test/​smoke/​scripts/​run-agents-window-wsl-kerberos-proxy.ps1	Adds suite selection and preserves earlier smoke logs.
test/​smoke/​README.md	Documents suite selection, compatibility requirements, and CI coverage.
build/​lib/​test/​testCheckpointTemplates.test.ts	Updates checkpoint and WSL lifecycle expectations.
build/​azure-pipelines/​win32/​steps/​product-build-win32-test.yml	Adds the checkpointed Kerberos run and matching-server setup.
build/​azure-pipelines/​win32/​product-build-win32-test.yml	Forwards Linux compilation artifact availability.
build/​azure-pipelines/​product-build.yml	Enables the checkpoint and matching-server support.
build/​azure-pipelines/​product-build-template.yml	Mirrors the product pipeline wiring.
build/​azure-pipelines/​product-build-ado-ci.yml	Enables the Kerberos smoke checkpoint in Azure CI.
build/​azure-pipelines/​common/​testCheckpoint.ts	Registers the new checkpoint identifier.
build/​azure-pipelines/​common/​publish-test-checkpoint.yml	Allows publishing the new checkpoint.
.github/​workflows/​pr-win32-test.yml	Runs the Agents Window Kerberos suite in Windows smoke shard 1.

_{Review effort: Balanced}