fix(api-proxy): add Azure/AWS/GCP OIDC support to Copilot adapter#4407
Conversation
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
Suggested title: The |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
@copilot resolve the merge conflicts in this pull request |
…-byok-aoai-entra # Conflicts: # src/constants/placeholders.test.ts
Claude Engine Smoke Test
Result: PASS
|
🔬 Smoke Test Results
PR: fix(api-proxy): add Azure/AWS/GCP OIDC support to Copilot adapter Overall: PASS
|
|
Smoke test results:
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "registry.npmjs.org"See Network Configuration for more information.
|
Chroot Smoke Test Results
Overall: ❌ FAILED — Python and Node.js versions differ between host and chroot environments.
|
🔑 Copilot BYOK (Direct) Smoke Test — PASS ✅Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com
Last 2 merged PRs:
cc author
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
Smoke Test Results
Overall: FAIL —
|
Smoke Test: API Proxy OpenTelemetry Tracing
All scenarios pass. OTEL tracing integration is complete and working.
|
Smoke Test Results
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra Overall Status: PASS cc: Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "api.openai.com"See Network Configuration for more information.
|
Smoke Test Results (Direct BYOK AOAI api-key)
Thanks
|
|
Gemini Smoke Test started. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
There was a problem hiding this comment.
Pull request overview
This PR extends the api-proxy sidecar’s Copilot provider adapter (port 10002) to support GitHub Actions OIDC-based auth (Azure/AWS/GCP) for direct-BYOK scenarios (notably Azure OpenAI via Entra), and adds a dedicated smoke workflow to validate the end-to-end OIDC→Entra token exchange path.
Changes:
- Add OIDC-aware auth handling to the Copilot adapter, including Azure/GCP Bearer token injection and AWS credential-provider plumbing.
- Add Copilot-adapter Azure OIDC unit tests covering provider exposure, header injection, enablement gating, and OIDC-specific 503 messaging.
- Add a new smoke workflow (and lock file) and allow
login.microsoftonline.comegress for Entra token exchange.
Show a summary per file
| File | Description |
|---|---|
containers/api-proxy/providers/copilot.js |
Adds OIDC provider construction (Azure/AWS/GCP), readiness-based enablement, and OIDC-specific responses/validation behavior. |
containers/api-proxy/server.auth.test.js |
Adds unit tests validating Azure OIDC behavior for the Copilot adapter. |
.github/workflows/smoke-copilot-byok-aoai-entra.md |
Introduces a new smoke workflow for Copilot CLI direct BYOK to Azure OpenAI via Entra (GitHub OIDC). |
.github/workflows/smoke-copilot-byok-aoai-entra.lock.yml |
Generated lockfile for the new smoke workflow, including allowed domain updates. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 4/4 changed files
- Comments generated: 4
| // authToken is consumed by the existing validation/models-fetch/auth-header paths. | ||
| // For OIDC mode the token isn't available synchronously at construction time, so | ||
| // we surface a non-empty marker here to keep alwaysBind/isEnabled probes happy and | ||
| // resolve the real token lazily inside getAuthHeaders. | ||
| const authToken = staticAuthToken; |
| # strict-mode compilation. AWF still forwards these values exclusively to the | ||
| # api-proxy sidecar (see src/services/api-proxy-service-config.ts); they are | ||
| # never written into the agent container's env. |
| if (authProvider === 'aws') { | ||
| const roleArn = env.AWF_AUTH_AWS_ROLE_ARN; | ||
| const region = env.AWF_AUTH_AWS_REGION; | ||
| if (roleArn && region) { | ||
| const { AwsOidcTokenProvider } = require('../aws-oidc-token-provider'); |
| } else if (authProvider === 'gcp') { | ||
| const workloadIdentityProvider = env.AWF_AUTH_GCP_WORKLOAD_IDENTITY_PROVIDER; | ||
| if (workloadIdentityProvider) { | ||
| const { GcpOidcTokenProvider } = require('../gcp-oidc-token-provider'); | ||
| oidcProvider = new GcpOidcTokenProvider({ |
The
smoke-copilot-byok-aoai-entraagent job was failing with repeated503 Credentials for GitHub Copilot (port 10002) are not configurederrors. The new workflow exercises Copilot CLI BYOK against Azure OpenAI via GitHub OIDC → Entra federation, but the api-proxy's Copilot adapter only knew about staticCOPILOT_GITHUB_TOKEN/COPILOT_PROVIDER_API_KEYcredentials — there was no path to mint an Azure AD token from the OIDC env vars.Since
src/services/api-proxy-credential-env.tsrewritesCOPILOT_PROVIDER_BASE_URLto the port-10002 sidecar whenever any Copilot env is set, Copilot CLI traffic always lands on this adapter regardless of upstream, so the gap had to be closed there.Changes
containers/api-proxy/providers/copilot.js— mirror theopenai.jsOIDC pattern:OidcTokenProvider(Azure),AwsOidcTokenProvider, orGcpOidcTokenProviderwhenAWF_AUTH_TYPE=github-oidcand no static credential is set; static keys still win.getOidcProvider()/getAwsOidcProvider()sostartup.jsawaits.initialize()before serving traffic.isEnabled(),getAuthHeaders()(****** from the cached AAD token),getValidationProbe()/getModelsFetchConfig()(skipped in OIDC mode — tokens aren't synchronously available at construct time), andgetUnconfigured{Response,HealthResponse}(OIDC-specific 503 message)./modelsGitHub-OAuth special case and BYOK extra-header/body-field gating on the static API key are preserved unchanged.containers/api-proxy/server.auth.test.js— 7 new tests covering: provider exposure, ****** injection when ready, empty headers before readiness,isEnabledlifecycle, OIDC-specific 503 body, default (no-OIDC) behavior, and static-key precedence over OIDC..github/workflows/smoke-copilot-byok-aoai-entra.{md,lock.yml}— allowlogin.microsoftonline.comin the smoke workflow'snetwork.allowedlist. The api-proxy sidecar and agent share an egress allowlist via Squid, so the Entra token endpoint must be reachable for the GitHub OIDC → Azure AD exchange to succeed.src/constants/placeholders.test.ts— point the assertion atcopilot-byok.js(whereCOPILOT_PLACEHOLDER_TOKENnow lives after main's refactor) and parse the'ghu_' + 'a'.repeat(36)expression form.Out of scope