fix(api-proxy): correct auth prefix for derived GHEC Copilot targets - #6991
Conversation
Treat derived GHEC Copilot API endpoints as targets that require the token auth prefix. Cover inferred targets and explicit GHEC platform routing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Updates Copilot API auth-prefix selection so that derived GHEC data-residency targets (copilot-api.<tenant>.ghe.com) use the GitHub-token token Authorization prefix instead of Bearer, and adjusts tests accordingly.
Changes:
- Add detection for GHEC data-residency Copilot API targets and treat them as requiring the
tokenprefix. - Update existing tests (and add new ones) to assert
tokenprefix behavior for*.ghe.comCopilot targets. - Refresh inline documentation explaining the prefix decision ordering.
Show a summary per file
| File | Description |
|---|---|
| containers/api-proxy/server.auth-matrix.test.js | Updates matrix expectation for GHEC-DR targets to use token prefix. |
| containers/api-proxy/providers/copilot-auth.js | Adds host-shape detection for copilot-api.<tenant>.ghe.com and updates decision logic/docs. |
| containers/api-proxy/copilot-auth.test.js | Updates/extends unit tests to cover GHEC-DR targets (including AWF_PLATFORM_TYPE=ghec). |
| containers/api-proxy/copilot-adapter-enterprise.test.js | Updates adapter auth-header expectations for derived GHEC-DR targets and adds coverage. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 4/4 changed files
- Comments generated: 3
- Review effort level: Lite
| function isGhecCopilotApiTarget(target) { | ||
| return target.startsWith('copilot-api.') | ||
| && target.endsWith('.ghe.com') | ||
| && target.length > 'copilot-api..ghe.com'.length; | ||
| } |
| it('returns true for a GHEC data-residency Copilot target', () => { | ||
| expect(copilotTargetRequiresGitHubTokenPrefix('copilot-api.myorg.ghe.com', { | ||
| GITHUB_SERVER_URL: 'https://myorg.ghe.com', | ||
| })).toBe(false); | ||
| })).toBe(true); | ||
| }); | ||
|
|
||
| it('returns true for a GHEC data-residency Copilot target with AWF_PLATFORM_TYPE=ghec', () => { | ||
| expect(copilotTargetRequiresGitHubTokenPrefix('copilot-api.myorg.ghe.com', { | ||
| AWF_PLATFORM_TYPE: 'ghec', | ||
| GITHUB_SERVER_URL: 'https://myorg.ghe.com', | ||
| })).toBe(true); | ||
| }); |
| it('uses "token" prefix for a derived GHEC data-residency target', () => { | ||
| const adapter = createCopilotAdapter({ | ||
| COPILOT_GITHUB_TOKEN: 'ghu_ghec_token_123', | ||
| GITHUB_SERVER_URL: 'https://mycompany.ghe.com', | ||
| }); | ||
| const headers = adapter.getAuthHeaders(fakeReq); | ||
| expect(headers['Authorization']).toBe(bearerGhecToken); | ||
| expect(headers['Authorization']).toBe('token ghu_ghec_token_123'); | ||
| }); |
|
@copilot address review feedback |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Addressed in
|
|
✅ Copilot review passed with no inline comments. @copilot Add the |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 98.90% | 98.94% | 📈 +0.04% |
| Statements | 98.79% | 98.80% | ➡️ +0.01% |
| Functions | 99.10% | 98.67% | 📉 -0.43% |
| Branches | 94.99% | 95.06% | 📈 +0.07% |
📁 Per-file Coverage Changes (2 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/commands/build-config.ts |
97.3% → 97.4% (+0.07%) | 97.3% → 97.4% (+0.07%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
✨ New Files (4 files)
src/enclave/information-budget.ts: 100.0% linessrc/enclave/preflight.ts: 100.0% linessrc/parsers/enclave-parser.ts: 100.0% linessrc/types/enclave-options.ts: 100.0% lines
Coverage comparison generated by scripts/ci/compare-coverage.ts
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
|
🛡️ Smoke Copilot Network Isolation reports failed to deliver outputs while checking network isolation. Investigate the egress model. |
|
✅ Smoke Gemini completed. All facets verified. 💎 Smoke test completed with partial failures. Comment added to PR #6991. |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
📰 DEVELOPING STORY: Smoke Copilot reports failed to deliver outputs. Our correspondents are investigating the incident... |
|
✅ Contribution Check completed successfully! PR #6991 follows the contributing guidelines: it includes regression tests for the new auth-prefix behavior, the description is clear and references Fixes #6989, and the touched files are in the correct package directories. No additional review comment needed. |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
📰 DEVELOPING STORY: Smoke Docker Sbx reports failed to deliver outputs. Our correspondents are investigating the incident... |
|
Build Test Failed Build Test Suite - See logs for details |
|
🔌 Smoke Services — All services reachable! ✅ |
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓 |
Smoke Test: Claude Engine Validation
Overall result: PASS
|
|
Smoke Test: Copilot BYOK (Direct Mode) ✅ PASS
Running in direct BYOK mode via cc
|
|
Smoke Test: Copilot Engine —
Overall: PASS
|
|
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable Overall: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
Chroot Version Comparison
Overall: FAILED — Node.js version mismatch between host (v24.18.0) and chroot (v22.23.2) environments.
|
Smoke Test: GitHub Actions Services Connectivity
Overall: FAIL — host.docker.internal could not be resolved from the AWF sandbox.
|
Smoke Test: Gemini Engine Validation
Overall status: FAIL
|
|
chore: upgrade gh-aw to v0.86.0 pre-release and recompile workflows: ✅
|
OTel Tracing Smoke Test Results
All scenarios pass or degrade gracefully as expected. No regressions detected.
|
|
Smoke test: FAIL Merged PRs:
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS Notes:
|
Smoke Test: Docker Sbx Validation
Overall: PASS PRs referenced: "chore: upgrade gh-aw to v0.86.0 pre-release and recompile workflows", "fix(api-proxy): stop alias fallback picking arbitrary models" cc
|
PR #6991 fixed the GHEC data-residency Copilot target (copilot-api.<subdomain>.ghe.com) to require the 'token' Authorization prefix instead of 'Bearer', matching the enterprise and business targets' behavior. The auth matrix documentation still described GHEC as using 'Bearer', which is now stale. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs: correct GHEC Copilot auth header prefix to token PR #6991 fixed the GHEC data-residency Copilot target (copilot-api.<subdomain>.ghe.com) to require the 'token' Authorization prefix instead of 'Bearer', matching the enterprise and business targets' behavior. The auth matrix documentation still described GHEC as using 'Bearer', which is now stale. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * test: accept curl timeout exit code Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 63e49e51-2ce5-4e18-93c5-bc8e398f4a3e --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Landon Cox <landon.cox@microsoft.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: 63e49e51-2ce5-4e18-93c5-bc8e398f4a3e
Summary
copilot-api.<tenant>.ghe.comendpoints as GitHub-hosted GHEC data-residency targetstokenauthorization prefix while preservingBearerfor BYOK credentials and the standard Copilot endpointAWF_PLATFORM_TYPE=ghec,/models, and the auth matrixTesting
npm run buildnpm run lintnpm testcd containers/api-proxy && npm test -- --runInBandFixes #6989