fix: pass GITHUB_SERVER_URL to DIFC proxy container for GHEC support

[Copilot]

The DIFC proxy container was not receiving GITHUB_SERVER_URL, so on GHEC tenants it defaulted to routing upstream requests to api.github.com instead of api.TENANT.ghe.com — silently breaking integrity filtering for pre-agent gh CLI and actions/github-script steps.

Changes

• actions/setup/sh/start_difc_proxy.sh: Add -e GITHUB_SERVER_URL to the docker run invocation; document the var in the script header.

docker run -d --name awmg-proxy --network host \
  -e GH_TOKEN \
+ -e GITHUB_SERVER_URL \
  -e DEBUG='*' \
  ...

• pkg/workflow/compiler_difc_proxy.go: Explicitly emit GITHUB_SERVER_URL: ${{ github.server_url }} in the generated step env — consistent with how the MCP gateway already passes it (mcp_setup_generator.go:641).

• pkg/workflow/compiler_difc_proxy_test.go: Assert GITHUB_SERVER_URL is present in the generated step YAML.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE go env on' --ignore-path ../../../.pret.prettierignore GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE go env on' --ignore-path ../../../.pret.prettierignore GO111MODULE node GOINSECURE GOMOD GOMODCACHE go (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GOMOD GOMODCACHE go env on' --ignore-pat-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ../pkg/workflow/js/**/*.json' ---p GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility */*.ts' '**/*.json' --ignore-path ../../../.pret--log-level=error GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env */*.json' '!../.-f GO111MODULE 64/pkg/tool/linu-f GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linumcp/notion (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ../pkg/workflow/js/**/*.json' --ignore-path ../../../.prettierignore GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha ./../pkg/workflo-errorsas GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.