[docs] auth: docs: document GITHUB_RUN_ID/GITHUB_RUN_ATTEMPT forwarding to api-proxy sidecar - #7570
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
github-actions
Bot
added
ai-generated
documentation
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
✅ Smoke Claude passed
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓
|
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓
|
|
✅ Build Test Suite completed successfully!
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 3 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "msfeed2.pkgs.visualstudio.com"
- "msfeed25.pkgs.visualstudio.com"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
🚀 Security Guard has started processing this pull request |
|
Chroot tests failed Smoke Chroot failed - See logs for details.
|
|
✅ Contribution Check completed successfully! Reviewed PR #7570 against CONTRIBUTING.md using the provided context. The change is documentation-only, is placed correctly under docs/, and the PR description clearly explains the update and references the related behavior; no missing contribution-guideline items found.
|
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
✅ Smoke Test: Copilot BYOK (Direct) Mode PASSED
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY).
|
Smoke Test: Claude Engine Validation
Overall result: PASS
|
|
Smoke Test: Docker Sbx —
Overall: PASS
|
|
Smoke Test: API Proxy OTEL Tracing — Results
Overall: all scenarios pass or are expected-pending (no unexpected failures). OTEL initialization, env propagation, and hook points are correctly wired; end-to-end span export for actual proxied API calls needs a live LLM-call scenario to fully exercise, which is outside this smoke test's scope.
|
|
Copilot Engine Smoke Test
Recent PRs checked: #7568 "Fix Cloud Hypervisor guest loopback networking", #7566 "[docs] Update for Copilot Auto API versions and Cloud Hypervisor network readiness" Overall: PASS cc
|
|
Smoke Test: Copilot BYOK (AZOAI)
|
|
Overall status: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
github-actions
Bot
added
the
smoke-copilot-network-isolation
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Note: Maven's default local repository at All other ecosystems ran cleanly with no errors.
|
|
Smoke test: FAIL PR titles:
✅ Merged PR review Warning Firewall blocked 3 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "msfeed2.pkgs.visualstudio.com"
- "msfeed25.pkgs.visualstudio.com"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
Fix Cloud Hypervisor guest loopback networking ✅
|
|
Services Connectivity Smoke Test
All checks failed: Overall: FAIL
|
1 participant
Summary
src/services/api-proxy-env-config.ts,src/services/api-proxy-credential-env.ts,src/services/agent-environment/excluded-vars.ts,src/services/agent-environment/env-passthrough.ts,containers/api-proxy/management.js,containers/api-proxy/startup.js,containers/agent/api-proxy-health-check.sh, andcontainers/api-proxy/request-headers.js.docs/environment.md,docs/auth-matrix.md, anddocs/authentication-architecture.md— no changes needed there.docs/auth-matrix.mdwith theX-Interaction-Id/Copilot-Integration-Idheader behavior, including that the sidecar derivesX-Interaction-Idfrom${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}. However,docs/api-proxy-sidecar.md's "API proxy container" environment-variable table (the canonical per-container env reference) never listedGITHUB_RUN_ID/GITHUB_RUN_ATTEMPTas variables forwarded to that container, even thoughsrc/services/api-proxy-env-config.tsforwards both from the host when present (confirmed in code, lines ~134–139).Documentation Changes
docs/api-proxy-sidecar.md(§Environment variables → API proxy container table): Added two rows forGITHUB_RUN_IDandGITHUB_RUN_ATTEMPT, describing their conditional forwarding from the host and their role deriving the stable per-runX-Interaction-IdCopilot prompt-cache key, cross-linking to the existingauth-matrix.mdsection that documents the resulting header behavior.Validation
src/services/api-proxy-env-config.ts(lines 134–139) forwardsGITHUB_RUN_ID/GITHUB_RUN_ATTEMPTconditionally when non-blank.containers/api-proxy/request-headers.js(resolveCopilotInteractionId) consumes exactly these two variables to deriveX-Interaction-Id, matching the already-documented behavior indocs/auth-matrix.md.npx markdownlint-cli2 docs/api-proxy-sidecar.md— 0 issues.[docs] auth:in the title covers this finding (checked via GitHub search; no open PRs at scan time).Sources
src/services/api-proxy-env-config.ts,containers/api-proxy/request-headers.js(repository source of truth)