fix(claude): inject COPILOT_GITHUB_TOKEN, scope ANTHROPIC_BASE_URL to Anthropic provider, fix provider-aware api-proxy reflect check, convert Copilot env vars to Anthropic vars in harness, fix smoke model for reasoning effort, and mark model-provider: ... by Copilot · Pull Request #40930 · github/gh-aw

Copilot · 2026-06-23T03:44:46Z

With model-provider: github, the claude engine never set COPILOT_GITHUB_TOKEN directly. The AWF api-proxy reads COPILOT_GITHUB_TOKEN from the host env to configure the copilot backend — without it, port 10002 showed ❌ and every inference call returned 401. Additionally, ANTHROPIC_BASE_URL was not being set for the Anthropic provider when the firewall was enabled, causing traffic to bypass the Claude gateway proxy. The claude_harness.cjs always fetched the api-proxy /reflect endpoint on the hardcoded Anthropic port (10000), which is never started when only GitHub/Copilot credentials are configured. Claude CLI inside the agent container had no ANTHROPIC_BASE_URL or ANTHROPIC_API_KEY when model-provider: github was used, so it could not route requests through the Copilot api-proxy at port 10002. Finally, the smoke workflow used claude-haiku-4.5 which does not support the output_config.effort: "high" parameter that Claude CLI sends when CLAUDE_CODE_DISABLE_FAST_MODE=1, causing GitHub Copilot API to return 400 on every inference call.

Changes

pkg/workflow/claude_engine.go:
- ANTHROPIC_API_KEY is now only injected when provider == LLMProviderAnthropic; it is not needed for the GitHub/Copilot provider.
- ANTHROPIC_BASE_URL is now only set when provider == LLMProviderAnthropic and the firewall is enabled (port 10000). It is not set for the GitHub/Copilot provider — Claude CLI does not route GitHub Copilot requests through ANTHROPIC_BASE_URL, so setting it to port 10002 caused the agent step to fail.
- When firewall is enabled and provider == LLMProviderGitHub, COPILOT_GITHUB_TOKEN is injected into the step env. The existing --exclude-env COPILOT_GITHUB_TOKEN AWF flag already prevents the token from reaching the agent container.

// ANTHROPIC_API_KEY is only set for the Anthropic provider:
if provider == LLMProviderAnthropic {
    env["ANTHROPIC_API_KEY"] = llmProviderSecretExpression(provider, workflowData)
}
// ANTHROPIC_BASE_URL is only needed for the Anthropic provider to route Claude CLI through the gateway:
if isFirewallEnabled(workflowData) && provider == LLMProviderAnthropic {
    env["ANTHROPIC_BASE_URL"] = llmProviderGatewayBaseURL(provider)
}
// COPILOT_GITHUB_TOKEN is set for the GitHub provider so the api-proxy can configure the copilot backend:
if isFirewallEnabled(workflowData) && provider == LLMProviderGitHub {
    env["COPILOT_GITHUB_TOKEN"] = llmProviderSecretExpression(provider, workflowData)
}

pkg/workflow/claude_engine_test.go — updates assertions: ANTHROPIC_API_KEY and ANTHROPIC_BASE_URL must not be present when using the GitHub provider; COPILOT_GITHUB_TOKEN must be present; TestClaudeEngineLLMProviderAnthropicFirewallUsesClaudeGatewayPort asserts port 10000 is used for Anthropic with firewall enabled.
pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden — updated to include ANTHROPIC_BASE_URL: http://host.docker.internal:10000 for the Anthropic provider.
.github/workflows/smoke-claude-on-copilot.md — changed model from claude-haiku-4.5 to claude-opus-4.7. claude-haiku-4.5 does not support the output_config.effort: "high" parameter that Claude CLI sends when CLAUDE_CODE_DISABLE_FAST_MODE=1; claude-opus-4.7 supports reasoning effort and works correctly with the Copilot api-proxy.
.github/workflows/smoke-claude-on-copilot.lock.yml — recompiled; ANTHROPIC_API_KEY and ANTHROPIC_BASE_URL no longer appear in the GitHub provider execution step; COPILOT_GITHUB_TOKEN is set for the GitHub provider; model updated to claude-opus-4.7; the Anthropic detection step retains ANTHROPIC_BASE_URL: http://host.docker.internal:10000.
actions/setup/js/awf_reflect.cjs — added AWF_API_PROXY_PROVIDER_PORTS table (anthropic→10000, openai→10001, github→10002) and resolveAWFReflectUrl(providerOverride?) helper that reads GH_AW_LLM_PROVIDER to return the correct api-proxy /reflect URL for the active provider. The AWF api-proxy only starts the sidecar ports whose credentials are configured; using a hardcoded port for the wrong provider results in a connection failure.
actions/setup/js/claude_harness.cjs:
- Both pre-run and post-run fetchAWFReflect calls now pass reflectUrl: resolveAWFReflectUrl() so the correct provider port is queried (e.g. port 10002 for GitHub/Copilot instead of the default Anthropic port 10000).
- Added buildClaudeGitHubProviderEnv() helper: when GH_AW_LLM_PROVIDER=github, it injects ANTHROPIC_BASE_URL=http://api-proxy:10002 and ANTHROPIC_API_KEY=copilot (placeholder; the api-proxy handles Copilot authentication itself via COPILOT_GITHUB_TOKEN from the runner's host environment) into the Claude CLI subprocess env. This converted env is passed to every runProcess call in the retry loop.
actions/setup/js/awf_reflect.test.cjs — new tests for resolveAWFReflectUrl covering all three providers, GH_AW_LLM_PROVIDER env var reading, unknown-provider fallback, and case-insensitivity.
actions/setup/js/claude_harness.test.cjs — new tests for buildClaudeGitHubProviderEnv covering non-github providers returning undefined, correct ANTHROPIC_BASE_URL/ANTHROPIC_API_KEY injection for the github provider, preservation of existing env vars, and case-insensitivity.
pkg/workflow/compiler_validators.go — added an experimental feature warning that fires when the Claude engine is configured with engine.model-provider: github. The warning "Using experimental feature: engine.model-provider: github (claude)" is emitted at compile time to signal that this provider combination is not yet stable.
pkg/workflow/compiler_validators_test.go — new tests for the experimental warning covering: github provider → warning emitted, anthropic provider → no warning, no provider → no warning, non-claude engine with github provider → no warning, nil engine config → no warning.

…i-proxy configuration When model-provider: github is used with the claude engine, the compiled workflow sets ANTHROPIC_API_KEY=${{ secrets.COPILOT_GITHUB_TOKEN }} and routes ANTHROPIC_BASE_URL to port 10002 (copilot provider). However, the api-proxy container needs COPILOT_GITHUB_TOKEN set directly in the host environment to configure the copilot backend at that port. Without COPILOT_GITHUB_TOKEN in the step env, the api-proxy copilot provider shows ❌ (unconfigured) and every inference request returns 401 Unauthorized. The fix injects COPILOT_GITHUB_TOKEN alongside ANTHROPIC_API_KEY when firewall is enabled and model-provider is github. The --exclude-env COPILOT_GITHUB_TOKEN flag already prevents the raw token from reaching the agent container. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-06-23T03:47:20Z

@copilot the Anthropic API key is not needed when the provider is github. Only needed for the Anthropic provider.

Fixed — ANTHROPIC_API_KEY is now only injected when provider == LLMProviderAnthropic. For the GitHub/Copilot provider, only COPILOT_GITHUB_TOKEN is set. The lock file and test have been updated accordingly.

…t GitHub Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-06-23T04:09:02Z

            -- /bin/bash -c 'set +o histexpand; export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && : "${RUNNER_TOOL_CACHE:?RUNNER_TOOL_CACHE must be set}"; GH_AW_TOOL_CACHE="$RUNNER_TOOL_CACHE"; export PATH="$(find "$GH_AW_TOOL_CACHE" -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; GH_AW_NPM_GLOBAL_ROOT="$(npm root -g 2>/dev/null || true)"; if [ -n "$GH_AW_NPM_GLOBAL_ROOT" ]; then export NODE_PATH="${GH_AW_NPM_GLOBAL_ROOT}${NODE_PATH:+:${NODE_PATH}}"; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/claude_harness.cjs claude --print --no-chrome --allowed-tools '\''Bash,BashOutput,Edit,Edit(/tmp/*),Edit(/tmp/gh-aw/agent/*),ExitPlanMode,Glob,Grep,KillBash,LS,MultiEdit,MultiEdit(/tmp/*),MultiEdit(/tmp/gh-aw/agent/*),NotebookEdit,NotebookRead,Read,Read(/tmp/*),Read(/tmp/gh-aw/agent/*),Task,TodoWrite,Write,Write(/tmp/*),Write(/tmp/gh-aw/agent/*),mcp__github__actions_get,mcp__github__actions_list,mcp__github__get_code_scanning_alert,mcp__github__get_commit,mcp__github__get_dependabot_alert,mcp__github__get_discussion,mcp__github__get_discussion_comments,mcp__github__get_file_contents,mcp__github__get_job_logs,mcp__github__get_label,mcp__github__get_latest_release,mcp__github__get_me,mcp__github__get_notification_details,mcp__github__get_pull_request,mcp__github__get_pull_request_comments,mcp__github__get_pull_request_diff,mcp__github__get_pull_request_files,mcp__github__get_pull_request_review_comments,mcp__github__get_pull_request_reviews,mcp__github__get_pull_request_status,mcp__github__get_release_by_tag,mcp__github__get_secret_scanning_alert,mcp__github__get_tag,mcp__github__issue_read,mcp__github__list_branches,mcp__github__list_code_scanning_alerts,mcp__github__list_commits,mcp__github__list_dependabot_alerts,mcp__github__list_discussion_categories,mcp__github__list_discussions,mcp__github__list_issue_types,mcp__github__list_issues,mcp__github__list_label,mcp__github__list_notifications,mcp__github__list_pull_requests,mcp__github__list_releases,mcp__github__list_secret_scanning_alerts,mcp__github__list_starred_repositories,mcp__github__list_tags,mcp__github__pull_request_read,mcp__github__search_code,mcp__github__search_issues,mcp__github__search_orgs,mcp__github__search_pull_requests,mcp__github__search_repositories,mcp__github__search_users,mcp__safeoutputs'\'' --debug-file /tmp/gh-aw/agent-stdio.log --verbose --permission-mode acceptEdits --output-format stream-json --bare --mcp-config "${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
        env:
-          ANTHROPIC_API_KEY: ${{ secrets.COPILOT_GITHUB_TOKEN }}
          ANTHROPIC_BASE_URL: http://host.docker.internal:10002


@copilot make sure the base url matches the selected provider

Fixed — ANTHROPIC_BASE_URL is now set for all providers when the firewall is enabled, using llmProviderGatewayBaseURL(provider) which returns the correct port per provider (Anthropic → 10000, GitHub → 10002). The golden file and lock file have been updated accordingly.

…s enabled Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-06-23T04:30:54Z

/smoke-claude-on-copilot

github-actions · 2026-06-23T04:31:37Z

❌ Smoke Claude on Copilot failed. Please review the logs for details.

pelikhan · 2026-06-23T04:47:55Z

@copilot the check for the api proxy must be aware for the provider endpoint.

See failure https://github.com/github/gh-aw/actions/runs/28002330929/job/82877200032#step:26:1

…arness Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-23T05:08:45Z

@copilot the check for the api proxy must be aware for the provider endpoint.

See failure https://github.com/github/gh-aw/actions/runs/28002330929/job/82877200032#step:26:1

Fixed in the latest commit. The root cause was that claude_harness.cjs called fetchAWFReflect without a reflectUrl, defaulting to http://api-proxy:10000/reflect (the Anthropic port). When model-provider: github is used, only port 10002 (Copilot) is started — port 10000 is never opened — so the reflect fetch failed/timed out.

Changes:

Added AWF_API_PROXY_PROVIDER_PORTS table and resolveAWFReflectUrl(provider?) to awf_reflect.cjs, mapping GH_AW_LLM_PROVIDER → correct api-proxy port (anthropic→10000, openai→10001, github→10002)
Updated both fetchAWFReflect calls in claude_harness.cjs to pass reflectUrl: resolveAWFReflectUrl()
Added tests covering all three providers, env var fallback, unknown-provider fallback, and case-insensitivity

pelikhan · 2026-06-23T05:10:54Z

/smoke-claude-on-copilot

github-actions · 2026-06-23T05:12:22Z

❌ Smoke Claude on Copilot failed. Please review the logs for details.

Copilot · 2026-06-23T06:40:17Z

@copilot the claude harness needs to convert the copilot env variables into Anthropic variables so that claude can connect through the proxy.

See failure https://github.com/github/gh-aw/actions/runs/...

Fixed in the latest commit. Added buildClaudeGitHubProviderEnv to claude_harness.cjs — when GH_AW_LLM_PROVIDER=github, it injects ANTHROPIC_BASE_URL=http://api-proxy:10002 and ANTHROPIC_API_KEY=copilot (placeholder; the proxy handles Copilot auth itself) into the child process env. The converted env is passed to every runProcess call in the retry loop. 8 new unit tests cover all branches.

…EN doc in buildClaudeGitHubProviderEnv Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-06-23T06:45:02Z

/smoke-claude-on-copilot

github-actions · 2026-06-23T06:45:57Z

❌ Smoke Claude on Copilot failed. Please review the logs for details.

Copilot

Pull request overview

This PR fixes Claude/Copilot (GitHub provider) execution under the AWF firewall by correctly wiring provider-specific env vars and by making the harness/reflect probing provider-aware so it queries the api-proxy port that is actually started.

Changes:

Update Claude engine env injection to (a) only set ANTHROPIC_* for the Anthropic provider and (b) inject COPILOT_GITHUB_TOKEN for the GitHub provider when the firewall is enabled.
Add provider→port mapping and provider-aware reflect URL resolution in the JS harness/reflection helpers; update Claude harness to use the provider-aware reflect URL and to translate GitHub-provider env into Anthropic vars for the Claude CLI subprocess.
Recompile goldens/lockfiles to reflect the new ANTHROPIC_BASE_URL behavior for the Anthropic provider.

Show a summary per file

File	Description
pkg/workflow/claude_engine.go	Adjust provider-scoped env injection (`ANTHROPIC_*` vs `COPILOT_GITHUB_TOKEN`) for AWF + Claude.
pkg/workflow/claude_engine_test.go	Update/add tests for GitHub-provider and Anthropic+firewall gateway port behavior.
pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden	Update golden to include Anthropic firewall gateway `ANTHROPIC_BASE_URL` (port 10000).
actions/setup/js/awf_reflect.cjs	Add provider→port mapping and `resolveAWFReflectUrl()` helper for provider-aware `/reflect` URL selection.
actions/setup/js/awf_reflect.test.cjs	Add tests covering provider-aware reflect URL resolution and port table export.
actions/setup/js/claude_harness.cjs	Use provider-aware reflect URL; add GitHub-provider env conversion for Claude CLI subprocess.
actions/setup/js/claude_harness.test.cjs	Add tests for GitHub-provider env conversion helper.
.github/workflows/typist.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/test-create-pr-error-handling.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/step-name-alignment.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/static-analysis-report.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/smoke-claude.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/smoke-agent-scoped-approved.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/smoke-agent-public-none.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/smoke-agent-public-approved.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/smoke-agent-all-none.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/smoke-agent-all-merged.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/sergo.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/semantic-function-refactor.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/scout.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/safe-output-health.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/ruflo-backed-task.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/prompt-clustering-analysis.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/portfolio-analyst.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/lockfile-stats.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/instructions-janitor.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/hourly-ci-cleaner.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/go-pattern-detector.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/go-logger.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/github-mcp-tools-report.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/github-mcp-structural-analysis.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/example-workflow-analyzer.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/developer-docs-consolidator.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/design-decision-gate.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/deep-report.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-token-consumption-report.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-team-evolution-insights.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-security-red-team.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-safeoutputs-git-simulator.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-safe-outputs-conformance.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-safe-output-optimizer.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-rendering-scripts-verifier.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-reliability-review.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-doc-healer.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-code-metrics.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-choice-test.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-caveman-optimizer.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-aw-cross-repo-compile-check.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/daily-agentrx-trace-optimizer.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/copilot-session-insights.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/copilot-agent-analysis.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/cloclo.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/cli-version-checker.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/claude-code-user-docs-review.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/ci-doctor.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/blog-auditor.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/aw-failure-investigator.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/avenger.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/audit-workflows.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/approach-validator.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.
.github/workflows/api-consumption-report.lock.yml	Recompiled: add Anthropic firewall `ANTHROPIC_BASE_URL` (port 10000) where applicable.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 64/64 changed files
Comments generated: 2

 * The /reflect endpoint is exposed by the api-proxy sidecar on each started provider port.
- * The active provider's gateway port should be used rather than a hardcoded port, since
- * port 10000 (the OpenAI sidecar) is only started when OpenAI credentials are configured.
+ * Use resolveAWFReflectUrl() to obtain the correct URL for the active provider, since only
+ * the ports whose provider credentials are configured are actually started.
 * This information is saved to AWF_REFLECT_OUTPUT_PATH so the post-run GitHub Actions step


+	// When using the GitHub/Copilot provider (model-provider: github), the api-proxy container
+	// needs COPILOT_GITHUB_TOKEN in the host environment to configure the copilot provider at
+	// port CopilotLLMGatewayPort. COPILOT_GITHUB_TOKEN is already excluded from the agent
+	// container via ExcludeEnvVarNames, so injecting it here only makes it available to the
+	// api-proxy, not to the agent process.


github-actions · 2026-06-23T06:55:48Z

@copilot review all comments and address unresolved review feedback.
Please refresh the branch, rerun checks, and summarize the remaining blockers.

Generated by 👨‍🍳 PR Sous Chef · 56.4 AIC · ⌖ 1.01 AIC · ⊞ 17.3K · ◷

pelikhan · 2026-06-23T13:45:22Z

@copilot review failure https://github.com/github/gh-aw/actions/runs/28007703332/job/82893503146

…ort reasoning effort Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-23T15:06:18Z

@copilot review failure https://github.com/github/gh-aw/actions/runs/28007703332/job/82893503146

The failure at step 26 was:

API Error: 400 output_config.effort "high" was provided, but model claude-haiku-4.5 does not support reasoning effort

Root cause: the Copilot proxy at port 10002 correctly receives Claude CLI requests (routing is working), but CLAUDE_CODE_DISABLE_FAST_MODE=1 causes Claude CLI to send output_config.effort: "high" — GitHub Copilot API rejects this for claude-haiku-4.5 which doesn't support reasoning effort.

Fix: changed the smoke workflow model from claude-haiku-4.5 to claude-opus-4.7, which supports reasoning effort.

pelikhan · 2026-06-23T18:41:49Z

/smoke-claude-on-copilot

github-actions · 2026-06-23T18:42:48Z

❌ Smoke Claude on Copilot failed. Please review the logs for details.

pelikhan · 2026-06-23T18:59:52Z

@copilot mark this feature as experimental

github-actions · 2026-06-23T19:06:57Z

@copilot please reply to the latest request with the current status and remaining experimental caveats.

Generated by 👨‍🍳 PR Sous Chef · 39.7 AIC · ⌖ 1.05 AIC · ⊞ 17.3K · ◷

…aude) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-23T19:18:12Z

@copilot mark this feature as experimental

Done — added an experimental feature warning in emitExperimentalFeatureWarnings that fires when engine.id == "claude" and engine.model-provider == "github". The warning reads "Using experimental feature: engine.model-provider: github (claude)". Added tests covering all branches (github provider → warning, anthropic provider → no warning, nil config → no warning, non-claude engine with github → no warning).

github-actions · 2026-06-23T19:52:35Z

``
@copilot review all comments and address unresolved review feedback.

Generated by 👨‍🍳 PR Sous Chef · 43.4 AIC · ⌖ 1.09 AIC · ⊞ 17.3K · ◷

github-actions · 2026-06-23T19:52:35Z

``
Please rebase onto main, rerun checks, and summarize any remaining blockers.

Generated by 👨‍🍳 PR Sous Chef · 43.4 AIC · ⌖ 1.09 AIC · ⊞ 17.3K · ◷

Copilot AI assigned Copilot and pelikhan Jun 23, 2026

Copilot AI changed the title ~~Fix claude engine github provider: inject COPILOT_GITHUB_TOKEN for api-proxy configuration~~ fix(claude): inject COPILOT_GITHUB_TOKEN for api-proxy when model-provider=github Jun 23, 2026

Copilot AI requested a review from pelikhan June 23, 2026 03:45

Copilot created this pull request from a session on behalf of pelikhan June 23, 2026 03:45 View session

Copilot finished work on behalf of pelikhan June 23, 2026 03:45

pelikhan reviewed Jun 23, 2026

View reviewed changes

Copilot started work on behalf of pelikhan June 23, 2026 03:47 View session

fix(claude): only inject ANTHROPIC_API_KEY for Anthropic provider, no…

eb47501

…t GitHub Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI requested a review from pelikhan June 23, 2026 03:59

Copilot finished work on behalf of pelikhan June 23, 2026 03:59

pelikhan reviewed Jun 23, 2026

View reviewed changes

Copilot started work on behalf of pelikhan June 23, 2026 04:09 View session

fix(claude): set ANTHROPIC_BASE_URL for all providers when firewall i…

1e63d90

…s enabled Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~fix(claude): inject COPILOT_GITHUB_TOKEN for api-proxy when model-provider=github~~ fix(claude): inject COPILOT_GITHUB_TOKEN and fix ANTHROPIC_BASE_URL per provider when model-provider=github Jun 23, 2026

Copilot finished work on behalf of pelikhan June 23, 2026 04:23

Copilot AI requested a review from pelikhan June 23, 2026 04:23

Copilot started work on behalf of pelikhan June 23, 2026 04:48 View session

github-actions Bot mentioned this pull request Jun 23, 2026

Smoke Test: Copilot - 28002778481 #40945

Closed

Copilot AI and others added 2 commits June 23, 2026 05:06

fix(claude): make api-proxy /reflect check provider-aware in claude_h…

9e321f7

…arness Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix(claude): simplify nullish coalescing in resolveAWFReflectUrl

9677bfa

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan June 23, 2026 05:09

fix(claude): remove redundant fallback and clarify COPILOT_GITHUB_TOK…

941e4ae

…EN doc in buildClaudeGitHubProviderEnv Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan June 23, 2026 06:42

pelikhan marked this pull request as ready for review June 23, 2026 06:45

Copilot AI review requested due to automatic review settings June 23, 2026 06:45

Copilot started reviewing on behalf of pelikhan June 23, 2026 06:46 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jun 23, 2026

[aw] No-Op Runs #39849

Open

Copilot started work on behalf of pelikhan June 23, 2026 14:47 View session

fix(smoke-claude-on-copilot): change model to claude-opus-4.7 to supp…

915c1e1

…ort reasoning effort Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan June 23, 2026 15:07

github-actions Bot mentioned this pull request Jun 23, 2026

[aw] Smoke Claude on Copilot failed #41091

Open

Copilot started work on behalf of pelikhan June 23, 2026 19:07 View session

feat(claude): add experimental warning for model-provider: github (cl…

d15f5a4

…aude) Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan June 23, 2026 19:19

Conversation

Copilot AI commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

pelikhan Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Jun 23, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented Jun 23, 2026

Uh oh!

Copilot AI commented Jun 23, 2026

Uh oh!

pelikhan commented Jun 23, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI commented Jun 23, 2026

Uh oh!

pelikhan commented Jun 23, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actions Bot commented Jun 23, 2026

Uh oh!

pelikhan commented Jun 23, 2026

Uh oh!

Copilot AI commented Jun 23, 2026

Uh oh!

pelikhan commented Jun 23, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented Jun 23, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026

Uh oh!

Copilot AI commented Jun 23, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jun 23, 2026 •

edited

Loading

github-actions Bot commented Jun 23, 2026 •

edited

Loading

github-actions Bot commented Jun 23, 2026 •

edited

Loading

github-actions Bot commented Jun 23, 2026 •

edited

Loading

github-actions Bot commented Jun 23, 2026 •

edited

Loading