fix: propagate apiProxy.auth OIDC config fields to all layers#5559
Conversation
The 17 apiProxy.auth.* fields defined in the JSON schema and documented in the spec §5 CLI mapping (type, provider, oidcAudience, azureTenantId, azureClientId, azureScope, azureCloud, awsRoleArn, awsRegion, awsRoleSessionName, gcpWorkloadIdentityProvider, gcpServiceAccount, gcpScope, anthropicFederationRuleId, anthropicOrganizationId, anthropicServiceAccountId, anthropicWorkspaceId) were documented as config-file fields mapping to AWF_AUTH_* env vars, but were missing from all four wiring layers: 1. AwfFileConfig interface in config-file.ts 2. mapAwfFileConfigToCliOptions() mapping 3. ApiProxyCredentialOptions TypeScript type 4. buildApiProxyBaseEnv() env-var generation in api-proxy-env-config.ts Only anthropicTokenUrl was previously wired end-to-end. Changes: - config-file.ts: expand AwfFileConfig.apiProxy.auth with all 17 fields; add corresponding mappings in mapAwfFileConfigToCliOptions() - api-proxy-credential-options.ts: add 17 new option key fields with JSDoc - build-config.ts: wire each new option with process.env fallback (options.authXxx || process.env.AWF_AUTH_XXX), matching the existing anthropicTokenUrl pattern - api-proxy-env-config.ts: update normalizedAuthType to prefer config.authType over process.env (config-file > env precedence); add explicit AWF_AUTH_* env-var generation from config fields so config-file values override host env vars (spread after pickEnvVars) - Tests: add config-file-mapping tests for all new auth fields; add OIDC tests verifying config.authType path triggers ACTIONS_ID_TOKEN_* forwarding and that Azure/provider fields flow through correctly Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR fixes an end-to-end configuration wiring gap where many apiProxy.auth.* OIDC fields were accepted by the JSON schema but were not propagated through the config-file → CLI options → WrapperConfig → api-proxy container environment pipeline, resulting in silent runtime ignores. It also corrects OIDC runtime token forwarding so config-file–provided authType enables forwarding of ACTIONS_ID_TOKEN_REQUEST_*.
Changes:
- Extend config-file parsing/mapping to include the previously-unwired
apiProxy.auth.*OIDC fields. - Add the corresponding
ApiProxyCredentialOptionsfields and wire them intobuildConfig()withAWF_AUTH_*env fallbacks. - Update api-proxy env generation to (a) use
config.authTypewhen deciding to forward GitHub OIDC runtime tokens and (b) pass through the newAWF_AUTH_*variables; add tests covering these paths.
Show a summary per file
| File | Description |
|---|---|
| src/types/api-proxy-credential-options.ts | Adds new typed option fields for OIDC auth configuration (mapped to AWF_AUTH_*). |
| src/services/api-proxy-service-oidc.test.ts | Adds tests for OIDC runtime token forwarding and config-driven AWF_AUTH_* env wiring. |
| src/services/api-proxy-env-config.ts | Ensures normalizedAuthType checks config.authType first; forwards OIDC config fields to api-proxy env. |
| src/config-file.ts | Extends AwfFileConfig and mapAwfFileConfigToCliOptions() to include OIDC auth fields from config file. |
| src/config-file-mapping.test.ts | Adds tests verifying config-file → CLI-option mapping for the new OIDC auth fields. |
| src/commands/build-config.ts | Wires new auth* fields into the resulting WrapperConfig, with AWF_AUTH_* env fallbacks. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 6/6 changed files
- Comments generated: 1
- Review effort level: Low
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
✅ Copilot review passed with no inline comments. @github-actions[bot] Add the |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 98.24% | 98.28% | 📈 +0.04% |
| Statements | 98.17% | 98.21% | 📈 +0.04% |
| Functions | 99.53% | 99.53% | ➡️ +0.00% |
| Branches | 94.29% | 94.00% | 📉 -0.29% |
📁 Per-file Coverage Changes (1 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/workdir-setup.ts |
92.7% → 94.5% (+1.82%) | 92.7% → 94.5% (+1.82%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓 Smoke test comment posted and label added for PR #5559 |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
🔌 Smoke Services — All services reachable! ✅ |
|
✅ Smoke Claude passed |
|
✅ Smoke Gemini completed. All facets verified. 💎 Smoke test completed with partial failures. Summary posted to PR #5559. |
|
✅ Build Test Suite completed successfully! |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
🚀 Security Guard has started processing this pull request |
|
✅ Contribution Check completed successfully! Contribution guidelines review complete for PR #5559. The PR includes relevant tests, uses appropriate src/ test file organization, has a clear description, and does not appear to require additional documentation because the affected fields were already documented. |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓 |
|
🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅ |
Smoke Test: Claude Engine
Overall result: PASS
|
🔬 Smoke Test Results
PR: fix: propagate apiProxy.auth OIDC config fields to all layers Overall: FAIL — pre-computed test data was not passed (workflow template variables unresolved)
|
🔐 Smoke Test: Copilot PAT — PASS
Overall: PASS · Auth mode: PAT (COPILOT_GITHUB_TOKEN)
|
🔍 Smoke Test: API Proxy OpenTelemetry Tracing
All 5 scenarios pass. OTEL tracing integration is complete and functional.
|
Smoke Test: Copilot BYOK ✅ PASSRunning in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com Test Results:
Mode: Direct BYOK
|
Smoke Test: Gemini Engine Validation
Overall Status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
Chroot Version Comparison Results
Overall:
|
|
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra Overall: PASS
|
|
Smoke test: PASS Merged PRs:
Queried PRs:
Checks:
Overall: PASS
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS
|
|
fix: propagate apiProxy.auth OIDC config fields to all layers ✅ MCP connectivity Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) Overall: PASS cc:
|
Smoke Test Results
Overall: FAIL
|
Config Consistency Fixes
Automated audit of PRs merged in the last 7 days (first run, no prior state; audited through PR #5549).
Gap Found:
apiProxy.authOIDC fields not wired end-to-endThe JSON schema (
src/awf-config-schema.json/docs/awf-config.schema.json) and spec §5 CLI mapping define 18apiProxy.auth.*fields. OnlyanthropicTokenUrlwas fully wired through the config-file → TypeScript types → build-config → env-var pipeline. The other 17 fields were accepted by schema validation but silently ignored at runtime when set in a config file.apiProxy.auth.typeAwfFileConfiginterface, mapped toauthTypeoption, wired toAWF_AUTH_TYPEapiProxy.auth.providerAwfFileConfig, mapped toauthProvider, wired toAWF_AUTH_PROVIDERapiProxy.auth.oidcAudienceAwfFileConfig, mapped toauthOidcAudience, wired toAWF_AUTH_OIDC_AUDIENCEapiProxy.auth.azureTenantIdAwfFileConfig, mapped toauthAzureTenantId, wired toAWF_AUTH_AZURE_TENANT_IDapiProxy.auth.azureClientIdAwfFileConfig, mapped toauthAzureClientId, wired toAWF_AUTH_AZURE_CLIENT_IDapiProxy.auth.azureScopeAwfFileConfig, mapped toauthAzureScope, wired toAWF_AUTH_AZURE_SCOPEapiProxy.auth.azureCloudAwfFileConfig, mapped toauthAzureCloud, wired toAWF_AUTH_AZURE_CLOUDapiProxy.auth.awsRoleArnAwfFileConfig, mapped toauthAwsRoleArn, wired toAWF_AUTH_AWS_ROLE_ARNapiProxy.auth.awsRegionAwfFileConfig, mapped toauthAwsRegion, wired toAWF_AUTH_AWS_REGIONapiProxy.auth.awsRoleSessionNameAwfFileConfig, mapped toauthAwsRoleSessionName, wired toAWF_AUTH_AWS_ROLE_SESSION_NAMEapiProxy.auth.gcpWorkloadIdentityProviderAwfFileConfig, mapped toauthGcpWorkloadIdentityProvider, wired toAWF_AUTH_GCP_WORKLOAD_IDENTITY_PROVIDERapiProxy.auth.gcpServiceAccountAwfFileConfig, mapped toauthGcpServiceAccount, wired toAWF_AUTH_GCP_SERVICE_ACCOUNTapiProxy.auth.gcpScopeAwfFileConfig, mapped toauthGcpScope, wired toAWF_AUTH_GCP_SCOPEapiProxy.auth.anthropicFederationRuleIdAwfFileConfig, mapped toauthAnthropicFederationRuleId, wired toAWF_AUTH_ANTHROPIC_FEDERATION_RULE_IDapiProxy.auth.anthropicOrganizationIdAwfFileConfig, mapped toauthAnthropicOrganizationId, wired toAWF_AUTH_ANTHROPIC_ORGANIZATION_IDapiProxy.auth.anthropicServiceAccountIdAwfFileConfig, mapped toauthAnthropicServiceAccountId, wired toAWF_AUTH_ANTHROPIC_SERVICE_ACCOUNT_IDapiProxy.auth.anthropicWorkspaceIdAwfFileConfig, mapped toauthAnthropicWorkspaceId, wired toAWF_AUTH_ANTHROPIC_WORKSPACE_IDBonus fix:
normalizedAuthTypenow checksconfig.authTypeapi-proxy-env-config.tscomputednormalizedAuthTypeexclusively fromprocess.env.AWF_AUTH_TYPE. WhenapiProxy.auth.typeis set via config file, theACTIONS_ID_TOKEN_REQUEST_*GitHub OIDC tokens were not forwarded to the api-proxy container. This is now fixed:config.authTypeis checked first, falling back to the host env var.Layers Verified
src/awf-config-schema.jsondocs/awf-config.schema.jsondocs/awf-config-spec.md§5 CLI mappingsrc/config-file.tsAwfFileConfigsrc/config-file.tsmapAwfFileConfigToCliOptionssrc/types/api-proxy-credential-options.tssrc/commands/build-config.tsAWF_AUTH_*env fallbackssrc/services/api-proxy-env-config.tsnormalizedAuthTypeusesconfig.authType; 17 newAWF_AUTH_*env entriesSecurity Classification
All 17 new fields are non-sensitive configuration identifiers (auth type strings, tenant IDs used in keyless OIDC federation, provider URLs, service account emails). They contain no secrets or credentials. This is consistent with the spec's existing classification of them as
config-onlyfields.Verification
tsc --noEmit— clean)