🩺 Runner Doctor UpdateAdd C9 (GHEC derived Copilot auth prefix) and B20 (cli-proxy ENETUNREACH dual-homing) failure modes

[github-actions]

Summary

• Scan window: updated:>=2026-08-06 (github/gh-aw-firewall)
• Reviewed ~30 recently updated PRs/issues; 2 genuinely new, not-yet-captured lessons for the Self-Hosted Runner Doctor knowledge base. No open runner-doctor proposal duplicates these.

Proposed knowledge-base changes (.github/workflows/shared/self-hosted-failure-modes.md)

New row — Category C (append after C8):

ID	Signal	Root cause	Fix / flag	Probe	Citations
C9	400 bad request: Authorization header is badly formatted specifically on the derived GHEC data-residency Copilot target copilot-api.<tenant>.ghe.com (distinct from C8's api.business.githubcopilot.com); receives Bearer instead of required token prefix	copilotTargetRequiresGitHubTokenPrefix() did not recognize inferred copilot-api.*.ghe.com endpoints as GitHub-hosted GHEC data-residency targets requiring the token prefix	Fixed in AWF (PR #6991, merged 2026-08-08): added isGhecCopilotApiTarget() in containers/api-proxy/providers/copilot-auth.js; GitHub OAuth/PAT credentials now sent with token prefix to derived copilot-api.*.ghe.com targets while Bearer is preserved for BYOK credentials and the standard Copilot endpoint. Upgrade AWF to include #6991.	Inspect api-proxy logs for 400 on copilot-api.<tenant>.ghe.com; confirm GITHUB_SERVER_URL is *.ghe.com and the target is the derived Copilot endpoint (not api.business.githubcopilot.com)	#6989, #6991

New row — Category B (append after B19):

ID	Signal	Root cause	Fix / flag	Probe	Citations
B20	On ubuntu-latest/GitHub-hosted or plain self-hosted runners (no Tailscale/custom routing) in --network-isolation mode, awf-cli-proxy never becomes healthy: tcp-tunnel dials ENETUNREACH 172.17.0.1:18443 against host.docker.internal, exhausting the DIFC liveness probe and failing the workflow before the agent starts	awf-net is internal: true with no outbound route. Squid and api-proxy are already dual-homed onto the external bridge (awf-ext), but cli-proxy was left attached only to awf-net even though it sets extra_hosts: {'host.docker.internal': 'host-gateway'} to reach the external DIFC proxy. Without a route out, Docker's host-gateway falls back to the default bridge gateway (172.17.0.1), unreachable from the isolated network	Fixed in AWF (PR #7066, merged 2026-08-08): src/compose-generator.ts now attaches cli-proxy to EXTERNAL_BRIDGE_NAME (awf-ext) in addition to awf-net whenever networkIsolation is enabled and the cli-proxy service exists, matching the existing Squid/api-proxy dual-homing pattern. Upgrade AWF to include #7066.	Inspect cli-proxy logs for ENETUNREACH ... :18443; check generated compose for cli-proxy networks: — should list both awf-net and awf-ext on patched AWF; confirm --network-isolation is set with an external difcProxyHost	#7063, #7066

Proposed doctor changes (.github/workflows/self-hosted-runner-doctor.md)

Add to error-string quick lookup:

• ENETUNREACH ... :18443 (or default bridge gateway IP) from awf-cli-proxy in --network-isolation mode → B20
• 400 bad request: Authorization header is badly formatted on derived copilot-api.*.ghe.com target specifically (not api.business.githubcopilot.com) → C9 (distinguish from C8)

Proposed portable agent changes (.github/agents/self-hosted-runner-doctor.md)

Mirror the same two new rows (C9, B20) into the embedded catalog copy, and add the same two error-string lookup entries, so the portable agent stays in sync with the shared catalog and workflow doctor file.

Source issues and PRs

• fix(api-proxy): correct auth prefix for derived GHEC Copilot targets #6991 (fix(api-proxy): correct auth prefix for derived GHEC Copilot targets, fixes copilot-api.<subdomain>.ghe.com — AWF's own derived Copilot target for GHEC data-residency tenants — is absent from the auth-prefix decision and always receives Bearer #6989)
• [docs] auth: GHEC Copilot auth header prefix corrected to token #7120 (docs follow-up correcting auth-matrix.md for the same fix)
• Fix cli-proxy ENETUNREACH in network-isolation mode by dual-homing it on the external bridge #7066 (Fix cli-proxy ENETUNREACH in network-isolation mode by dual-homing it on the external bridge, fixes [awf] network-isolation: cli-proxy cannot reach the external DIFC proxy (ENETUNREACH to host gateway) on GitHub-hosted runners, no Tailscale - variant of #6704 #7063)

Generated by Runner Doctor Updater · auto · 46.3 AIC · ⊞ 38.1K · ◷

• expires on Sep 7, 2026, 7:08 PM UTC