Refactor Copilot auth routing to use shared GitHub server host classification#6400
Conversation
There was a problem hiding this comment.
Pull request overview
Centralizes GitHub server host classification for consistent Copilot authentication routing.
Changes:
- Adds a shared GitHub/GHEC/GHES host classifier.
- Reuses it across API target derivation and GHES detection.
- Adds focused classification tests.
Show a summary per file
| File | Description |
|---|---|
containers/api-proxy/providers/copilot-auth.js |
Centralizes host classification and updates routing helpers. |
containers/api-proxy/copilot-auth.test.js |
Tests all classification outcomes. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Medium
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤 |
|
🔑 Smoke Copilot PAT PAT auth validated. All systems operational. ✅ |
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
✅ Smoke Claude passed |
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓 |
|
✅ Build Test Suite completed successfully! |
|
✅ Smoke Gemini completed. All facets verified. 💎 Smoke test complete. Results: GitHub MCP ❌, Connectivity ❌, Files ✅, Bash ✅. Overall: FAIL. |
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓 |
|
✅ Contribution Check completed successfully! PR #6400 appears to follow the applicable CONTRIBUTING.md guidance: tests were added for the new helper, the PR description is clear and references #6393, and the changed files are in the correct container/test locations. No comment needed. |
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅ |
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded. |
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓 |
|
❌ Security Guard failed. Please review the logs for details. |
|
🔌 Smoke Services — All services reachable! ✅ |
Smoke Test: Copilot BYOK (Direct) Mode ✅ PASSTests:
Mode: Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test: PAT Auth — INCONCLUSIVE
Overall: INCONCLUSIVE — workflow template variables were not resolved before reaching the agent step. Auth mode: PAT (COPILOT_GITHUB_TOKEN) Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
🔬 Smoke Test Results
Overall: PASS PR author: Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test: Services Connectivity
Also tried Overall: FAIL — service containers not reachable from this runner environment. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
|
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Smoke Test: API Proxy OpenTelemetry Tracing
All 5 scenarios pass. OTEL tracing integration is working as expected. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
|
Smoke test: Copilot network isolation egress EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (api.github.com): HTTP 200 Overall: PASS
Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"
- "example.com"See Network Configuration for more information.
|
Chroot Version Comparison
Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
|
PR smoke summary:
Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"
- "registry.npmjs.org"See Network Configuration for more information.
|
Smoke Test Results
Overall status: FAIL Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — ✅ PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
🧪 Smoke Test Results — Docker Sbx
Overall: /cc
|
|
{"item_number":6400,"body":"
Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "awmgmcpg"See Network Configuration for more information.
|
Copilot auth routing duplicated
GITHUB_SERVER_URLparsing and.ghe.com/GHES classification across multiple helpers. This centralizes host classification so target derivation and GHES detection rely on one canonical decision path.What changed
classifyGithubServerHost(env)incontainers/api-proxy/providers/copilot-auth.jsto parse/classifyGITHUB_SERVER_URLonce:githubghec(+ extracted tenant subdomain)ghesmissinginvalidderiveCopilotApiTargetderiveGitHubApiTargetisGhesInstance_testingfor direct unit coverage.Test updates
containers/api-proxy/copilot-auth.test.jsfor:github.comclassification*.ghe.comclassification + subdomain extraction.ghe.comenterprise host classification as GHESResulting behavior model (now shared)