feat: add Auth Doctor Updater workflow - #6898
Merged
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79dfde80-9308-4d73-bd34-3ec5bc114cd7
Contributor
Contributor
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a community-facing Auth Doctor workflow for credential-safe authentication and API-proxy diagnostics.
Changes:
- Adds and compiles the
/auth-doctoragentic workflow. - Covers static, BYOK, cloud OIDC, and MCP gateway authentication paths.
- Updates authentication documentation and workflow validation.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/auth-doctor.md |
Defines the diagnostic workflow and safety playbook. |
.github/workflows/auth-doctor.lock.yml |
Compiled workflow definition. |
scripts/ci/auth-doctor-workflow.test.ts |
Validates workflow configuration and compilation. |
README.md |
Links the workflow and authentication matrix. |
docs/environment.md |
Documents OIDC environment boundaries. |
docs/diagnosing-awf-failures.md |
Directs authentication failures to Auth Doctor. |
docs/authentication-architecture.md |
Clarifies API-proxy and MCP OIDC trust paths. |
docs/auth-matrix.md |
Adds Auth Doctor and OIDC guidance. |
docs/api-proxy-sidecar.md |
Adds credential-safe troubleshooting guidance. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Suppressed comments (1)
.github/workflows/auth-doctor.md:137
- These expected routes exclude the supported Copilot OIDC topology. The same Azure, AWS, and GCP providers can authenticate the Copilot adapter on port 10002 (
docs/auth-matrix.md:165-173), so route diagnosis should distinguish both valid adapters instead of directing every setup to OpenAI/Vertex only. Update the route cells and regenerate the lock.
| Azure | `AWF_AUTH_AZURE_TENANT_ID`, `AWF_AUTH_AZURE_CLIENT_ID` | Azure OpenAI through the OpenAI adapter |
| AWS | `AWF_AUTH_AWS_ROLE_ARN`, `AWF_AUTH_AWS_REGION` | Bedrock with sidecar SigV4 signing |
| GCP | `AWF_AUTH_GCP_WORKLOAD_IDENTITY_PROVIDER`; service account optional | Vertex AI; optional service-account impersonation |
- Files reviewed: 9/9 changed files
- Comments generated: 5
- Review effort level: Balanced
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79dfde80-9308-4d73-bd34-3ec5bc114cd7
Contributor
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
lpcox
changed the title
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79dfde80-9308-4d73-bd34-3ec5bc114cd7
Resolve authentication documentation conflicts against the shipped sidecar-only Actions OIDC isolation and regenerate the updater workflow lock. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79dfde80-9308-4d73-bd34-3ec5bc114cd7
Use the available AJV release that avoids vulnerable fast-uri, and pin the docs build to a patched PostCSS release. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 79dfde80-9308-4d73-bd34-3ec5bc114cd7
This was referenced Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
noopwhen guidance is currentgh prmutation, and changes outside the approved documentation allowlistValidation
gh aw compile auth-doctor-updater --strict --validate --schedule-seed github/gh-aw-firewallnpm test -- --runInBand scripts/ci/auth-doctor-updater-workflow.test.tsnpm run buildnpm run lintnpm test -- --runInBand(305 suites, 5,359 passed, 1 skipped)npm run docs:buildLimitations
The updater researches public implementation metadata and provider guidance; it does not inspect live credentials, exchange tokens, or call inference APIs. It treats PR #6894 and github/gh-aw#50053 as related rollout/compatibility work and verifies default-branch status before describing behavior as shipped.