Skip to content

fix(api-proxy): correct auth prefix for derived GHEC Copilot targets - #6991

Merged
lpcox merged 5 commits into
mainfrom
copilot/fix-copilot-api-auth-prefix
Aug 8, 2026
Merged

fix(api-proxy): correct auth prefix for derived GHEC Copilot targets#6991
lpcox merged 5 commits into
mainfrom
copilot/fix-copilot-api-auth-prefix

Conversation

Copilot AI commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Summary

  • recognize derived copilot-api.<tenant>.ghe.com endpoints as GitHub-hosted GHEC data-residency targets
  • send GitHub OAuth/PAT credentials to those targets with the required token authorization prefix while preserving Bearer for BYOK credentials and the standard Copilot endpoint
  • add regression coverage for inferred GHEC targets, explicit AWF_PLATFORM_TYPE=ghec, /models, and the auth matrix
  • remove stale commentary that assumed automatic platform-type injection

Testing

  • npm run build
  • npm run lint
  • npm test
  • cd containers/api-proxy && npm test -- --runInBand

Fixes #6989

Treat derived GHEC Copilot API endpoints as targets that require the token auth prefix.

Cover inferred targets and explicit GHEC platform routing.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@lpcox lpcox changed the title [WIP] Fix auth-prefix decision for copilot-api derived target Fix auth prefix for derived GHEC Copilot targets Aug 6, 2026
@lpcox
lpcox marked this pull request as ready for review August 6, 2026 21:26
Copilot AI balanced review requested due to automatic review settings August 6, 2026 21:26

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Updates Copilot API auth-prefix selection so that derived GHEC data-residency targets (copilot-api.<tenant>.ghe.com) use the GitHub-token token Authorization prefix instead of Bearer, and adjusts tests accordingly.

Changes:

  • Add detection for GHEC data-residency Copilot API targets and treat them as requiring the token prefix.
  • Update existing tests (and add new ones) to assert token prefix behavior for *.ghe.com Copilot targets.
  • Refresh inline documentation explaining the prefix decision ordering.
Show a summary per file
File Description
containers/api-proxy/server.auth-matrix.test.js Updates matrix expectation for GHEC-DR targets to use token prefix.
containers/api-proxy/providers/copilot-auth.js Adds host-shape detection for copilot-api.<tenant>.ghe.com and updates decision logic/docs.
containers/api-proxy/copilot-auth.test.js Updates/extends unit tests to cover GHEC-DR targets (including AWF_PLATFORM_TYPE=ghec).
containers/api-proxy/copilot-adapter-enterprise.test.js Updates adapter auth-header expectations for derived GHEC-DR targets and adds coverage.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 4/4 changed files
  • Comments generated: 3
  • Review effort level: Lite

Comment on lines +247 to +251
function isGhecCopilotApiTarget(target) {
return target.startsWith('copilot-api.')
&& target.endsWith('.ghe.com')
&& target.length > 'copilot-api..ghe.com'.length;
}
Comment on lines +312 to 323
it('returns true for a GHEC data-residency Copilot target', () => {
expect(copilotTargetRequiresGitHubTokenPrefix('copilot-api.myorg.ghe.com', {
GITHUB_SERVER_URL: 'https://myorg.ghe.com',
})).toBe(false);
})).toBe(true);
});

it('returns true for a GHEC data-residency Copilot target with AWF_PLATFORM_TYPE=ghec', () => {
expect(copilotTargetRequiresGitHubTokenPrefix('copilot-api.myorg.ghe.com', {
AWF_PLATFORM_TYPE: 'ghec',
GITHUB_SERVER_URL: 'https://myorg.ghe.com',
})).toBe(true);
});
Comment on lines +58 to +65
it('uses "token" prefix for a derived GHEC data-residency target', () => {
const adapter = createCopilotAdapter({
COPILOT_GITHUB_TOKEN: 'ghu_ghec_token_123',
GITHUB_SERVER_URL: 'https://mycompany.ghe.com',
});
const headers = adapter.getAuthHeaders(fakeReq);
expect(headers['Authorization']).toBe(bearerGhecToken);
expect(headers['Authorization']).toBe('token ghu_ghec_token_123');
});
@lpcox

lpcox commented Aug 7, 2026

Copy link
Copy Markdown
Collaborator

@copilot address review feedback

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI commented Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

@copilot address review feedback

Addressed in be16e65.

  • Tightened GHEC derived target matching to only allow copilot-api.<single-label>.ghe.com.
  • Added negative regression tests for malformed/multi-label/suffix-trick hostnames.
  • Reintroduced a shared constant for repeated GHEC Authorization expectations in enterprise adapter tests.
  • Verified with targeted tests in containers/api-proxy.

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric Base PR Delta
Lines 98.90% 98.94% 📈 +0.04%
Statements 98.79% 98.80% ➡️ +0.01%
Functions 99.10% 98.67% 📉 -0.43%
Branches 94.99% 95.06% 📈 +0.07%
📁 Per-file Coverage Changes (2 files)
File Lines (Before → After) Statements (Before → After)
src/commands/build-config.ts 97.3% → 97.4% (+0.07%) 97.3% → 97.4% (+0.07%)
src/log-directory-setup.ts 96.2% → 100.0% (+3.78%) 96.3% → 100.0% (+3.71%)
✨ New Files (4 files)
  • src/enclave/information-budget.ts: 100.0% lines
  • src/enclave/preflight.ts: 100.0% lines
  • src/parsers/enclave-parser.ts: 100.0% lines
  • src/types/enclave-options.ts: 100.0% lines

Coverage comparison generated by scripts/ci/compare-coverage.ts

@lpcox lpcox changed the title Fix auth prefix for derived GHEC Copilot targets fix(api-proxy): correct auth prefix for derived GHEC Copilot targets Aug 7, 2026
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit fe892de

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

✅ Coverage Check Passed

Overall Coverage

Metric Base PR Delta
Lines 94.09% 94.11% 📈 +0.02%
Statements 93.06% 93.09% 📈 +0.03%
Functions 94.47% 94.47% ➡️ +0.00%
Branches 86.27% 86.29% 📈 +0.02%
📁 Per-file Coverage Changes (1 files)
File Lines (Before → After) Statements (Before → After)
src/log-directory-setup.ts 96.2% → 100.0% (+3.78%) 96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

🛡️ Smoke Copilot Network Isolation reports failed to deliver outputs while checking network isolation. Investigate the egress model.

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Smoke Gemini completed. All facets verified. 💎

Smoke test completed with partial failures. Comment added to PR #6991.

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

📰 DEVELOPING STORY: Smoke Copilot reports failed to deliver outputs. Our correspondents are investigating the incident...

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Contribution Check completed successfully!

PR #6991 follows the contributing guidelines: it includes regression tests for the new auth-prefix behavior, the description is clear and references Fixes #6989, and the touched files are in the correct package directories. No additional review comment needed.

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

📰 DEVELOPING STORY: Smoke Docker Sbx reports failed to deliver outputs. Our correspondents are investigating the incident...

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Build Test Failed Build Test Suite - See logs for details

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

🔌 Smoke Services — All services reachable! ✅

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: Claude Engine Validation

Check Status
API ✅ PASS
gh CLI ✅ PASS
File ✅ PASS

Overall result: PASS

Generated by Smoke Claude for #6991 · haiku45 · 60 AIC · ⊞ 3.6K ·
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: Copilot BYOK (Direct Mode) ✅ PASS

  • MCP connectivity ✅
  • GitHub.com HTTP 200 ✅
  • File write/read ✅
  • BYOK inference (agent → api-proxy → api.githubcopilot.com) ✅

Running in direct BYOK mode via COPILOT_PROVIDER_API_KEY with api-proxy sidecar.

cc @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: Copilot Engine@lpcox

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

@lpcox

  • Smoke Test: Copilot BYOK (Direct) Mode — Azure OpenAI (Foundry, api-key): ✅
  • GitHub.com connectivity: ✅
  • File write/read: ✅
  • BYOK inference: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall status: PASS

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

@lpcox

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable
✅ Blocked domain (example.com) denied

Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Chroot Version Comparison

Runtime Host Version Chroot Version Match?
Python Python 3.12.13 Python 3.12.13 ✅ YES
Node.js v24.18.0 v22.23.2 ❌ NO
Go go1.22.12 go1.22.12 ✅ YES

Overall: FAILED — Node.js version mismatch between host (v24.18.0) and chroot (v22.23.2) environments. smoke-chroot label not added.

Tested by Smoke Chroot
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: GitHub Actions Services Connectivity

  • Redis: ❌ (DNS resolution failed for host.docker.internal)
  • PostgreSQL pg_isready: ❌ (no response)
  • PostgreSQL SELECT 1: ❌ (DNS resolution failed)

Overall: FAIL — host.docker.internal could not be resolved from the AWF sandbox.

🔌 Service connectivity validated by Smoke Services
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: Gemini Engine Validation

  • GitHub MCP Testing: ❌ (Blocked by secrecy/integrity policy)
  • GitHub.com Connectivity: ❌ (HTTP 000 / DNS Fail)
  • File Writing Testing: ✅
  • Bash Tool Testing: ✅

Overall status: FAIL

💎 Faceted by Smoke Gemini
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

chore: upgrade gh-aw to v0.86.0 pre-release and recompile workflows: ✅
fix(api-proxy): stop alias fallback picking arbitrary models: ✅
GitHub.com connectivity: ✅
File write/read test: ✅
BYOK inference test: ✅
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra
Overall: PASS
@lpcox

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

OTel Tracing Smoke Test Results

  • Scenario 1 (Module Loading):otel.js loaded, isEnabled() returns true, exports startRequestSpan/setTokenAttributes/setBudgetAttributes/endSpan/endSpanError/shutdown/isEnabled + internals.
  • Scenario 2 (Test Suite): ✅ 68/68 tests passed (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js).
  • Scenario 3 (Env Var Forwarding):GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID present in env-passthrough.ts; GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, trace/span IDs present in api-proxy-env-config.ts.
  • Scenario 4 (Token Tracker Integration):onUsage callback present in token-tracker-http.js.
  • Scenario 5 (OTel Diagnostics): ⚠️ No otel.jsonl span file found this run (no OTLP endpoint configured for the API proxy in this sandbox session); token-usage.jsonl has 10 records, confirming graceful degradation (no errors) when OTEL export isn't active.

All scenarios pass or degrade gracefully as expected. No regressions detected.

📡 OTel tracing validated by Smoke OTel Tracing
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Smoke test: FAIL

Merged PRs:

  • chore: upgrade gh-aw to v0.86.0 pre-release and recompile workflows
  • fix(api-proxy): stop alias fallback picking arbitrary models
    Queried PRs:
  • Add A19/B19 runner doctor entries: ARC/DinD safeoutputs mount + rootless cleanup chmod noise
  • [WIP] Fix cli-proxy connectivity issue in network-isolation mode
    Checks: merged review ✅, safeinputs-gh query ❌, Playwright ✅, file write/cat ✅, discussion comment ❌, build ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

🏗️ Build Test Suite Results

Ecosystem Project Build/Install Tests Status
Bun elysia 1/1 passed ✅ PASS
Bun hono 1/1 passed ✅ PASS
C++ fmt N/A ✅ PASS
C++ json N/A ✅ PASS
Deno oak N/A 1/1 passed ✅ PASS
Deno std N/A 1/1 passed ✅ PASS
.NET hello-world N/A (run OK) ✅ PASS
.NET json-parse N/A (run OK) ✅ PASS
Go color passed ✅ PASS
Go env passed ✅ PASS
Go uuid passed ✅ PASS
Java gson 1/1 passed ✅ PASS
Java caffeine 1/1 passed ✅ PASS
Node.js clsx passed ✅ PASS
Node.js execa passed ✅ PASS
Node.js p-limit passed ✅ PASS
Rust fd 1/1 passed ✅ PASS
Rust zoxide 1/1 passed ✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Notes:

  • Java: Maven's shared ~/.m2 directory was not writable by the runner user, so -Dmaven.repo.local was pointed at a local writable path for compile/test; this is an environment quirk, not a firewall/build issue.
  • All other ecosystems installed/built/tested with no errors.

Generated by Build Test Suite for #6991 · auto · 61.1 AIC · ⊞ 11.5K ·
Add label ready-for-aw to run again

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Smoke Test: Docker Sbx Validation

  • ✅ GitHub MCP: connected, PR list retrieved
  • ✅ GitHub.com connectivity: HTTP 200
  • ✅ File write/read: verified

Overall: PASS

PRs referenced: "chore: upgrade gh-aw to v0.86.0 pre-release and recompile workflows", "fix(api-proxy): stop alias fallback picking arbitrary models"

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
Add label ready-for-aw to run again

@lpcox
lpcox merged commit 757b5d4 into main Aug 8, 2026
133 of 138 checks passed
@lpcox
lpcox deleted the copilot/fix-copilot-api-auth-prefix branch August 8, 2026 00:30
github-actions Bot added a commit that referenced this pull request Aug 8, 2026
PR #6991 fixed the GHEC data-residency Copilot target (copilot-api.<subdomain>.ghe.com)
to require the 'token' Authorization prefix instead of 'Bearer', matching the
enterprise and business targets' behavior. The auth matrix documentation still
described GHEC as using 'Bearer', which is now stale.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
lpcox added a commit that referenced this pull request Aug 9, 2026
* docs: correct GHEC Copilot auth header prefix to token

PR #6991 fixed the GHEC data-residency Copilot target (copilot-api.<subdomain>.ghe.com)
to require the 'token' Authorization prefix instead of 'Bearer', matching the
enterprise and business targets' behavior. The auth matrix documentation still
described GHEC as using 'Bearer', which is now stale.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* test: accept curl timeout exit code

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 63e49e51-2ce5-4e18-93c5-bc8e398f4a3e

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Landon Cox <landon.cox@microsoft.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot-Session: 63e49e51-2ce5-4e18-93c5-bc8e398f4a3e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

3 participants