feat(proxy): make copilot api target configurable for enterprise envi… by lpcox · Pull Request #1063 · github/gh-aw-firewall

lpcox · 2026-02-26T17:06:48Z

…ronments

Auto-derive api.enterprise.githubcopilot.com from GITHUB_SERVER_URL when the server is not github.com (GHEC/GHES). Allow explicit override via COPILOT_API_TARGET env var or --copilot-api-target CLI flag. Forward GITHUB_SERVER_URL and GITHUB_API_URL to both agent and api-proxy containers by default.

…ronments Auto-derive api.enterprise.githubcopilot.com from GITHUB_SERVER_URL when the server is not github.com (GHEC/GHES). Allow explicit override via COPILOT_API_TARGET env var or --copilot-api-target CLI flag. Forward GITHUB_SERVER_URL and GITHUB_API_URL to both agent and api-proxy containers by default.

github-actions · 2026-02-26T17:07:45Z

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	82.08%	82.16%	📈 +0.08%
Statements	82.03%	82.13%	📈 +0.10%
Functions	82.91%	82.91%	➡️ +0.00%
Branches	74.73%	74.46%	📉 -0.27%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	83.4% → 83.7% (+0.31%)	82.6% → 83.0% (+0.37%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-02-26T17:10:50Z

C++ Build Test Results

Project	CMake	Build	Status
fmt	✅	✅	PASS
json	✅	✅	PASS

Overall: PASS ✅

Generated by Build Test C++ for issue #1063

github-actions · 2026-02-26T17:10:52Z

Deno Build Test Results

Project	Tests	Status
oak	1/1	✅ PASS
std	1/1	✅ PASS

Overall: ✅ PASS

Generated by Build Test Deno for issue #1063

github-actions · 2026-02-26T17:11:01Z

Bun Build Test Results

Project	Install	Tests	Status
elysia	✅	1/1	PASS
hono	✅	1/1	PASS

Overall: PASS ✅

Tested with Bun v1.3.10

Generated by Build Test Bun for issue #1063

github-actions · 2026-02-26T17:11:06Z

Node.js Build Test Results

Project	Install	Tests	Status
clsx	✅	PASS	✅ PASS
execa	✅	PASS	✅ PASS
p-limit	✅	PASS	✅ PASS

Overall: ✅ PASS

Generated by Build Test Node.js for issue #1063

github-actions · 2026-02-26T17:11:09Z

Go Build Test Results ✅

Project	Download	Tests	Status
color	✅	PASS	PASS
env	✅	PASS	PASS
uuid	✅	PASS	PASS

Overall: PASS

Generated by Build Test Go for issue #1063

github-actions · 2026-02-26T17:11:09Z

.NET Build Test Results

Project	Restore	Build	Run	Status
hello-world	✅	✅	✅	PASS
json-parse	✅	✅	✅	PASS

Overall: PASS ✅

Run output

hello-world: Hello, World!

json-parse:

{
  "Name": "AWF Test",
  "Version": 1,
  "Success": true
}
Name: AWF Test, Success: True

Generated by Build Test .NET for issue #1063

github-actions · 2026-02-26T17:11:13Z

🤖 Smoke test results for @lpcox (no assignees):

✅ GitHub MCP — Last 2 merged PRs: #1056 "refactor: remove --allow-full-filesystem-access flag", #1055 "feat: add API proxy port 10004 for OpenCode engine"
✅ Playwright — github.com title contains "GitHub"
✅ File write — /tmp/gh-aw/agent/smoke-test-copilot-22452681514.txt created and verified
✅ Bash — file read back successfully

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot for issue #1063

github-actions · 2026-02-26T17:11:18Z

Smoke Test Results

Last 2 merged PRs:

refactor: remove --allow-full-filesystem-access flag #1056: refactor: remove --allow-full-filesystem-access flag
feat(proxy): add observability and rate limiting to API proxy #1038: feat(proxy): add observability and rate limiting to API proxy

Test	Result
GitHub MCP	✅
Playwright (github.com title)	✅
File write	✅
Bash verify	✅

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude for issue #1063

github-actions · 2026-02-26T17:11:24Z

Rust Build Test Results

Project	Build	Tests	Status
fd	✅	1/1	PASS
zoxide	✅	1/1	PASS

Overall: PASS ✅

Generated by Build Test Rust for issue #1063

Copilot

Pull request overview

Adds enterprise-friendly configuration for GitHub Copilot API routing when using the api-proxy sidecar, including automatic enterprise target selection and explicit overrides.

Changes:

Introduces copilotApiTarget config surface (CLI + env + WrapperConfig) for selecting the Copilot upstream host.
Updates api-proxy sidecar to auto-derive an enterprise Copilot target from GITHUB_SERVER_URL when applicable.
Forwards GitHub enterprise environment variables into the agent (and partially into the api-proxy).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/types.ts	Adds `copilotApiTarget` to `WrapperConfig` with documentation.
src/docker-manager.ts	Forwards `GITHUB_SERVER_URL`/`GITHUB_API_URL` to agent env; passes `COPILOT_API_TARGET` and `GITHUB_SERVER_URL` into api-proxy env.
src/cli.ts	Adds `--copilot-api-target` flag and wires it into config creation.
containers/api-proxy/server.js	Implements Copilot target derivation and uses it for upstream proxying.
containers/api-proxy/README.md	Documents `COPILOT_API_TARGET` for the sidecar.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-26T17:11:23Z

src/cli.ts

+    '                                   Defaults to api.githubcopilot.com. Useful for GHES deployments.\n' +
+    '                                   Can also be set via COPILOT_API_TARGET env var.',


CLI help text says the target "Defaults to api.githubcopilot.com", but the sidecar now auto-derives api.enterprise.githubcopilot.com when GITHUB_SERVER_URL is set to a non-github.com host. Please adjust the help text to avoid advertising an unconditional default (e.g., mention the enterprise auto-derive behavior and that the flag/env var overrides it).

Suggested change

' Defaults to api.githubcopilot.com. Useful for GHES deployments.\n' +

' Can also be set via COPILOT_API_TARGET env var.',

' Defaults to api.githubcopilot.com for GitHub.com.\n' +

' When GITHUB_SERVER_URL is set to a non-github.com host, defaults to api.enterprise.githubcopilot.com.\n' +

' This flag or the COPILOT_API_TARGET env var override the default.',

Copilot · 2026-02-26T17:11:24Z

src/docker-manager.ts

+        // Configurable Copilot API target (for GHES/GHEC support)
+        ...(config.copilotApiTarget && { COPILOT_API_TARGET: config.copilotApiTarget }),
+        // Forward GITHUB_SERVER_URL so api-proxy can auto-derive enterprise endpoints
+        ...(process.env.GITHUB_SERVER_URL && { GITHUB_SERVER_URL: process.env.GITHUB_SERVER_URL }),
        // Route through Squid to respect domain whitelisting


The api-proxy container is now deriving the Copilot target from GITHUB_SERVER_URL, but docker-compose only forwards GITHUB_SERVER_URL (not GITHUB_API_URL) into the api-proxy service. This differs from the PR description (“Forward GITHUB_SERVER_URL and GITHUB_API_URL to both agent and api-proxy containers by default”). Either forward GITHUB_API_URL as well, or update the PR description/docs to match what the proxy actually needs.

Copilot · 2026-02-26T17:11:24Z

containers/api-proxy/server.js

+  if (process.env.COPILOT_API_TARGET) {
+    return process.env.COPILOT_API_TARGET;


COPILOT_API_TARGET is used as a hostname in both new URL(req.url, \https://${targetHost}`)andhttps.request({ hostname: targetHost }), but deriveCopilotApiTarget()returns the env var verbatim. If a user supplies a full URL (e.g.,https://api.githubcopilot.com`) or includes a path/port/whitespace, requests can fail at runtime. Consider validating/normalizing this value (trim, reject / and scheme, or accept full URLs by parsing and extracting hostname).

Suggested change

if (process.env.COPILOT_API_TARGET) {

return process.env.COPILOT_API_TARGET;

const envTarget = process.env.COPILOT_API_TARGET;

if (envTarget) {

const trimmed = envTarget.trim();

if (trimmed) {

// If a full URL is provided (e.g., https://api.githubcopilot.com),

// parse it and extract the hostname so it can be safely used in

// https.request({ hostname }) and as a URL base.

if (trimmed.startsWith('http://') || trimmed.startsWith('https://')) {

try {

const url = new URL(trimmed);

if (url.hostname) {

return url.hostname;

}

} catch {

// Invalid URL — fall through to serverUrl/default handling below.

}

} else {

// Treat as a bare hostname. Reject obviously invalid forms that would

// break https.request/new URL usage (paths or whitespace).

if (!/[\/\s]/.test(trimmed)) {

return trimmed;

}

// If invalid, fall through to serverUrl/default handling.

}

}

Copilot · 2026-02-26T17:11:25Z

containers/api-proxy/server.js

+// Configurable Copilot API target host (supports GHES/GHEC / custom endpoints)
+// Priority: COPILOT_API_TARGET env var > auto-derive from GITHUB_SERVER_URL > default
+function deriveCopilotApiTarget() {
+  if (process.env.COPILOT_API_TARGET) {
+    return process.env.COPILOT_API_TARGET;


Please add test coverage for the new Copilot target selection logic: (1) COPILOT_API_TARGET override wins, and (2) non-github.com GITHUB_SERVER_URL causes the enterprise target to be used. Without a test, regressions here are easy to miss.

Copilot · 2026-02-26T17:11:25Z

containers/api-proxy/README.md

 - `ANTHROPIC_API_KEY` - Anthropic API key for authentication

+Optional:
+- `COPILOT_API_TARGET` - Target hostname for GitHub Copilot API requests (default: `api.githubcopilot.com`). Useful for GHES deployments.


README says the default target is always api.githubcopilot.com, but the proxy now auto-derives api.enterprise.githubcopilot.com when GITHUB_SERVER_URL is set to a non-github.com host. Please update this description to match the implemented precedence (explicit COPILOT_API_TARGET > derived from GITHUB_SERVER_URL > public default).

Suggested change

- `COPILOT_API_TARGET` - Target hostname for GitHub Copilot API requests (default: `api.githubcopilot.com`). Useful for GHES deployments.

- `COPILOT_API_TARGET` - Target hostname for GitHub Copilot API requests. If set, this value takes precedence. If unset and `GITHUB_SERVER_URL` points to a non-github.com host (e.g., GHES), the proxy will auto-derive `api.enterprise.githubcopilot.com`. Otherwise, the default is `api.githubcopilot.com`. Useful for GHES deployments.

Copilot · 2026-02-26T17:11:25Z

src/types.ts

+   * - CLI flag: `--copilot-api-target <host>`
+   * - Environment variable: `COPILOT_API_TARGET`
+   *
+   * @default 'api.githubcopilot.com'
+   * @example


The @default 'api.githubcopilot.com' claim isn’t always true anymore: the sidecar now auto-derives api.enterprise.githubcopilot.com when GITHUB_SERVER_URL is non-github.com. Please update the @default / description to reflect the actual precedence (explicit target > derived enterprise target > public default).

github-actions · 2026-02-26T17:11:40Z

PRs: feat(proxy): add observability and rate limiting to API proxy; refactor: remove --allow-full-filesystem-access flag
MCP merged PRs: ✅
safeinputs-gh PR list: ✅
Playwright title: ✅
Tavily search: ❌ (tool unavailable)
File write + cat: ✅
Discussion comment: ✅
Build (npm ci && npm run build): ✅
Overall: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1063

lpcox · 2026-02-26T17:12:00Z

@copilot take a look at this gh-aw compiler and see if it will pass the right environment variables to awf

github/gh-aw#18504

Copilot · 2026-02-26T17:12:08Z

@lpcox I've opened a new pull request, #1064, to work on those changes. Once the pull request is ready, I'll request review from you.

github-actions · 2026-02-26T17:12:40Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	`Python 3.12.12`	`Python 3.12.3`	❌ NO
Node.js	`v24.13.1`	`v20.20.0`	❌ NO
Go	`go1.22.12`	`go1.22.12`	✅ YES

Overall: ❌ Tests did not pass — Python and Node.js versions differ between host and chroot environment.

Tested by Smoke Chroot for issue #1063

github-actions · 2026-02-26T17:12:42Z

Java Build Test Results

Project	Compile	Tests	Status
gson	✅	1/1	PASS
caffeine	✅	1/1	PASS

Overall: PASS ✅

Generated by Build Test Java for issue #1063

Copilot AI review requested due to automatic review settings February 26, 2026 17:06

Copilot started reviewing on behalf of lpcox February 26, 2026 17:07 View session

github-actions bot added build-test-cpp build-test-deno labels Feb 26, 2026

github-actions bot added the build-test-bun label Feb 26, 2026

github-actions bot added the build-test-node label Feb 26, 2026

github-actions bot added build-test-go build-test-dotnet labels Feb 26, 2026

github-actions bot added the smoke-copilot label Feb 26, 2026

github-actions bot added the smoke-claude label Feb 26, 2026

github-actions bot added the build-test-rust label Feb 26, 2026

Copilot AI reviewed Feb 26, 2026

View reviewed changes

Copilot AI mentioned this pull request Feb 26, 2026

feat(proxy): make Copilot API target configurable for enterprise environments #1064

Draft

github-actions bot added the build-test-java label Feb 26, 2026

Mossaka approved these changes Feb 26, 2026

View reviewed changes

Mossaka merged commit b508e3f into main Feb 26, 2026
94 of 96 checks passed

Mossaka deleted the lpcox/configure-api-proxy-target branch February 26, 2026 17:23

		' Defaults to api.githubcopilot.com. Useful for GHES deployments.\n' +
		' Can also be set via COPILOT_API_TARGET env var.',

-    '                                   Defaults to api.githubcopilot.com. Useful for GHES deployments.\n' +
-    '                                   Can also be set via COPILOT_API_TARGET env var.',
+    '                                   Defaults to api.githubcopilot.com for GitHub.com.\n' +
+    '                                   When GITHUB_SERVER_URL is set to a non-github.com host, defaults to api.enterprise.githubcopilot.com.\n' +
+    '                                   This flag or the COPILOT_API_TARGET env var override the default.',

		if (process.env.COPILOT_API_TARGET) {
		return process.env.COPILOT_API_TARGET;

-  if (process.env.COPILOT_API_TARGET) {
-    return process.env.COPILOT_API_TARGET;
+  const envTarget = process.env.COPILOT_API_TARGET;
+  if (envTarget) {
+    const trimmed = envTarget.trim();
+    if (trimmed) {
+      // If a full URL is provided (e.g., https://api.githubcopilot.com),
+      // parse it and extract the hostname so it can be safely used in
+      // https.request({ hostname }) and as a URL base.
+      if (trimmed.startsWith('http://') || trimmed.startsWith('https://')) {
+        try {
+          const url = new URL(trimmed);
+          if (url.hostname) {
+            return url.hostname;
+          }
+        } catch {
+          // Invalid URL — fall through to serverUrl/default handling below.
+        }
+      } else {
+        // Treat as a bare hostname. Reject obviously invalid forms that would
+        // break https.request/new URL usage (paths or whitespace).
+        if (!/[\/\s]/.test(trimmed)) {
+          return trimmed;
+        }
+        // If invalid, fall through to serverUrl/default handling.
+      }
+    }

	- `COPILOT_API_TARGET` - Target hostname for GitHub Copilot API requests (default: `api.githubcopilot.com`). Useful for GHES deployments.
	- `COPILOT_API_TARGET` - Target hostname for GitHub Copilot API requests. If set, this value takes precedence. If unset and `GITHUB_SERVER_URL` points to a non-github.com host (e.g., GHES), the proxy will auto-derive `api.enterprise.githubcopilot.com`. Otherwise, the default is `api.githubcopilot.com`. Useful for GHES deployments.

Conversation

lpcox commented Feb 26, 2026

Uh oh!

github-actions bot commented Feb 26, 2026

⚠️ Coverage Regression Detected

Overall Coverage

Uh oh!

github-actions bot commented Feb 26, 2026

C++ Build Test Results

Uh oh!

github-actions bot commented Feb 26, 2026

Deno Build Test Results

Uh oh!

github-actions bot commented Feb 26, 2026

Bun Build Test Results

Uh oh!

github-actions bot commented Feb 26, 2026

Node.js Build Test Results

Uh oh!

github-actions bot commented Feb 26, 2026

Go Build Test Results ✅

Uh oh!

github-actions bot commented Feb 26, 2026

.NET Build Test Results

Uh oh!

github-actions bot commented Feb 26, 2026

Uh oh!

github-actions bot commented Feb 26, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Feb 26, 2026

Rust Build Test Results

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 26, 2026

Uh oh!

lpcox commented Feb 26, 2026

Uh oh!

Copilot AI commented Feb 26, 2026

Uh oh!

github-actions bot commented Feb 26, 2026

Chroot Version Comparison Results

Uh oh!

github-actions bot commented Feb 26, 2026

Java Build Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants