Fix Go network access for test coverage workflow

[lpcox]

Summary

• allow the Test Coverage Improver sandbox to access the curated Go module ecosystem
• regenerate the compiled workflow so Go module proxy and checksum domains are permitted
• resolve the missing-tool failure reported in [aw] Test Coverage Improver is missing required tool #10887

Closes #10887

[Copilot]

Pull request overview

Allows the Test Coverage Improver to download Go dependencies, resolving #10887.

Changes:

• Enables the curated Go network allowlist.
• Regenerates the compiled workflow with Go module domains.

Show a summary per file

File	Description
.github/workflows/test-coverage-improver.md	Adds Go network access.
.github/workflows/test-coverage-improver.lock.yml	Regenerates firewall configuration.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	✅
C	CLI	reads (list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue×2/comment/file)	gh: GH_TOKEN not set	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh: GH_TOKEN not set	BLOCKED	✅

Gateway enforcement (Part B): Write tools are stripped from the gateway-exposed tool list. Attempts return MCP error [-32602]: unknown tool — a gateway-specific refusal (backend has these tools; gateway does not surface them). This confirms enforcement is at the gateway layer, not merely backend configuration.

CLI enforcement (Parts D/E): gh has no GH_TOKEN, so all REST and GraphQL write attempts are rejected before reaching the API.

Overall: PASS

References: §31270010804

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues/get_file via github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	Bad credentials (401)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	Bad credentials (401)	BLOCKED	✅

Overall: PASS

Note: Part B writes were refused with Error [-32602]: unknown tool — gateway strips write tools from the MCP surface entirely. Parts D/E were rejected by GitHub API with 401 (unauthenticated gh CLI). References: §31270010763

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime