Skip to content

fix: strip URL scheme from expression-based API targets at runtime#25332

Closed
Copilot wants to merge 2 commits intomainfrom
copilot/deep-report-investigate-stalled-branch
Closed

fix: strip URL scheme from expression-based API targets at runtime#25332
Copilot wants to merge 2 commits intomainfrom
copilot/deep-report-investigate-stalled-branch

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 8, 2026

When ANTHROPIC_BASE_URL, OPENAI_BASE_URL, or GITHUB_COPILOT_BASE_URL is a GHA expression (${{ vars.MY_URL }}), extractAPITargetHost finds no :// at compile time and passes the raw expression verbatim as --*-api-target. At runtime the expression resolves to a full URL; the API proxy prepends https:// to what it expects to be a bare hostname, producing https://https://my-gateway.example.com → 403.

Hardcoded URLs are unaffected — extractAPITargetHost strips the scheme correctly at compile time.

Changes

  • isEnvVarExpression() — detects when an engine.env value is a GHA expression rather than a literal
  • buildExpressionAPITargetArgs() — for each expression-based API target var, generates:
    • A shell preamble using Bash parameter expansion to strip the scheme and path at runtime (single quotes in expressions are escaped)
    • An expandable --*-api-target "${_GH_AW_*_TARGET}" arg referencing the resulting shell variable
  • BuildAWFArgs() — skips expression-based targets from the static (compile-time) args list
  • BuildAWFCommand() — splices the expression preamble before the awf invocation, merged with the existing PathSetup preamble into a single code path

Generated shell for ANTHROPIC_BASE_URL: ${{ vars.ANTHROPIC_BASE_URL }}:

set -o pipefail
_GH_AW_ANTHROPIC_TARGET='${{ vars.ANTHROPIC_BASE_URL }}'; \
  _GH_AW_ANTHROPIC_TARGET="${_GH_AW_ANTHROPIC_TARGET#https://}"; \
  _GH_AW_ANTHROPIC_TARGET="${_GH_AW_ANTHROPIC_TARGET#http://}"; \
  _GH_AW_ANTHROPIC_TARGET="${_GH_AW_ANTHROPIC_TARGET%%/*}"
# shellcheck disable=SC1003
sudo -E awf ... --anthropic-api-target "${_GH_AW_ANTHROPIC_TARGET}" \
  -- ...

The runner resolves the expression before the shell executes, so _GH_AW_ANTHROPIC_TARGET receives https://my-gateway.example.com/path and is reduced to my-gateway.example.com before AWF sees it.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw .cfg /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel go /usr/bin/git 1 1 -parallel=4 /opt/hostedtoolc--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -d 168.63.129.16 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git /usr/bin/git go env -json GO111MODULE /sh GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -c=4 -nolocalimports -importcfg /tmp/go-build3072025922/b411/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/tar.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE y.s (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git _.a LamLkoYmy 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/link /usr/bin/git eutil.test GO111MODULE ortcfg.link git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha GOMODCACHE go /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link -json t layTitle /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link -o /tmp/go-build3072025922/b444/timeutil.test -importcfg /usr/bin/git -s -w -buildmode=exe git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha 972577/b120/_pkg_.a g/typeutil/convert.go .cfg GOINSECURE b/gh-aw/pkg/typeconfig GOMODCACHE ache/go/1.25.8/x^remote\..*\.gh-resolved$ env 972577/b138/_pkg_.a GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE e/jsonschema-go/rev-parse GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git efaultBranchFromgit efaultBranchFromrev-parse .cfg git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuorigin /usr/bin/git RequiresMinInteggit hxms/bWOB0OjYPOsrev-parse 2025922/b397/cli--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel git /usr/bin/git s/test.md go /usr/bin/gh git rev-�� --show-toplevel gh /usr/bin/git /repos/github/ghgit (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/gh _.a @v1.19.2/printerrev-parse 64/pkg/tool/linu--show-toplevel gh run download 1 /usr/bin/git test-logs/run-1 4GDF0MOYT 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git mLsRemoteWithReagit mLsRemoteWithRearev-parse 64/pkg/tool/linu--show-toplevel /usr/bin/git conf�� --get-regexp ^remote\..*\.gh-resolved$ /usr/bin/git y_with_explicit_git eF_9lmWUN 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha tags/v4 ache/go/1.25.8/x64/pkg/tool/linux_amd64/link /usr/bin/git 2025922/b455/scrgit rev-parse 2025922/b455/imp--show-toplevel git rev-�� --show-toplevel 7D8RXanEmFBss/sX9FX53sm1OTZ6jdpoJ_/CWrYu2czG7Ca7ylQP4Z8/vCNYLdc7D8RXanEmFBss /usr/bin/git ry=1 s/test.md 2025922/b455/_pk--show-toplevel git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build934972577/b243/importcfg -pack /home/REDACTED/go/pkg/mod/golang.org/x/text@v0.35.0/internal/language/compact/compact.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env sm-opt -Oz (size optimization)..."; \ BEFORE=$(wc -c < gh-aw.wasm); \ wasm-opt -Oz --enable-bugit GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 01 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE g/sig_other.s env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel 64/pkg/tool/linu-importcfg /usr/bin/gh y-test.md GO111MODULE 64/pkg/tool/linu--show-toplevel gh run download 3 /usr/bin/git test-logs/run-3 GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/infocmp LsRemoteWithRealgit LsRemoteWithRealrev-parse 64/pkg/tool/linu--show-toplevel infocmp -1 xterm-color 64/pkg/tool/linustatus /usr/bin/git _.a h1Ee82J5b 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmain_branch34remote.origin.urgit git-upload-pack '/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitmain_branch3467581185/001' ea6395f7bd33a95bf6ce061f1cef24363ac1805cc01e5e58-d --check scripts/**/*.js 64/bin/go git -C /tmp/gh-aw-test-runs/20260408-155449-32187/test-1175528150/.gith@{u} rev-parse 64/pkg/tool/linux_amd64/vet -json GO111MODULE 64/bin/go 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha -json GO111MODULE $name) { hasDiscussionsEnabled } } GOINSECURE GOMOD GOMODCACHE go /pre�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go /pre�� -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel 64/pkg/tool/linuremote.origin.url /usr/bin/gh ed-imports-enablgit @v1.1.3/cpu/arm/rev-parse 64/pkg/tool/linu--show-toplevel gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts /usr/bin/git .artifacts[].namgit 5.0/deviceauth.grev-parse 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha /tmp/go-build3072025922/b428/_pkg_.a -trimpath 1/x64/bin/node -p github.com/githurev-parse -lang=go1.25 1/x64/bin/node -C /tmp/TestGuardPolicyMinIntegrityOnlymin-integrity_with_repos_array_c866066302/001 remote /usr/bin/git -c=4 -nolocalimports -importcfg git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha 2025922/b448/_pkg_.a origin 2025922/b448=> --porcelain b/gh-aw/pkg/typerev-parse nch,headSha,disp--show-toplevel git -C bwyS/9k48_J27DlSaZ6QobwyS rev-parse /tmp/go-build3072025922/b426/repoutil.test -json GO111MODULE 64/bin/go 2025922/b448/importcfg (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE o8601 bis 64/pkg/tool/linuTest User env 3372179403 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 4GDF0MOYT 64/pkg/tool/linux_amd64/compile GOINSECURE l/errors GOMODCACHE 64/pkg/tool/linutest@example.com env g_.a GO111MODULE ache/go/1.25.8/x64/pkg/tool/linu-nilfunc GOINSECURE setup/js/node_mo/tmp/js-hash-test-3286727146/test-hash.js GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-tests (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name verutil.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a bbyq8rTOi ache/go/1.25.8/x64/pkg/tool/linu-nilfunc GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/xorigin (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 0/message/catalog/catalog.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD bis 64/pkg/tool/linux_amd64/compile env _.a YfB4YDUdE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE t GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name 4/apic.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a DfcRFzBGz x_amd64/compile GOINSECURE age/compact GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 0/internal/format/format.go 64/pkg/tool/linux_amd64/compile GOINSECURE l_wasm.o 64/src/internal/--show-toplevel 64/pkg/tool/linux_amd64/compile env _.a QuPWq4ACQ x_amd64/link GOINSECURE (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name 5.0/internal/doc.go 64/pkg/tool/linux_amd64/compile GOINSECURE (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 NgK5Xenpy ache/go/1.25.8/x64/bin/go GOINSECURE l/format GOMODCACHE go env t5smDhwOz GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name 5.0/deviceauth.go 64/pkg/tool/linux_amd64/compile GOINSECURE 64 bis 64/pkg/tool/linux_amd64/compile env 3372179403 rtcfg 64/pkg/tool/linux_amd64/vet GOINSECURE go-sdk/oauthex GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD bis 64/pkg/tool/linux_amd64/vet env -json Ffi6x77fi 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name rotocol/go-sdk@v1.5.0/oauthex/auth_meta.go 64/pkg/tool/linux_amd64/compile GOINSECURE (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 AmvwaUv3n 64/pkg/tool/linu-importcfg GOINSECURE (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name rotocol/go-sdk@v1.5.0/auth/auth.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env 3372179403 GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE go-sdk/mcp GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 S1XHWmzm6 64/pkg/tool/linux_amd64/cgo GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/cgo env rtcfg vohS5K4mu ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linu-trimpath (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path /tmp/go-build857-p -trimpath 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a m0O72i2Jk 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linu/tmp/go-build3072025922/b449/_testmain.go /usr/bin/git flow.lock.yml qrnP/bIu9B-2Kyy2rev-parse 972577/b174=> git rev-�� --show-toplevel git /usr/bin/git 972577/b050/impogit _L0m/ZbUGNwZMKnOrev-parse /opt/hostedtoolc--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha _.a QyquJZDcH /opt/hostedtoolcache/go/1.25.8/x64/bin/go GOINSECURE go-sdk/internal/rev-parse GOMODCACHE go env L5Pf2dzjr GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x^remote\..*\.gh-resolved$ (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json sonschema/annotations.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env Gitcustom_branch3251588246/001' Gitcustom_branch3251588246/001' x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env Gitmaster_branch2048250085/001' Gitmaster_branch2048250085/001' x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/-
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE sh GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha /workflows xpQFH7LFx /opt/hostedtoolcache/go/1.25.8/x-lang=go1.25 GOINSECURE go-sdk/internal/rev-parse GOMODCACHE go env 6/001/test-frontmatter-with-env-template-expressions.md GO111MODULE ache/go/1.25.8/x64/pkg/tool/linu-importcfg GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x--json (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE ove_wasm.o 64/src/runtime/m--show-toplevel 64/pkg/tool/linux_amd64/vet env 4162988677/custom/workflows JWpi-bmPh ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo -nolocalimports -importcfg /tmp/go-build3072025922/b415/importcfg -pack /tmp/go-build3072025922/b415/_testmain.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build3072025922/b397/cli.test /tmp/go-build3072025922/b397/cli.test -test.testlogfile=/tmp/go-build3072025922/b397/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -nolocalimports -importcfg /tmp/go-build934972577/b219/importcfg -pack -o /tmp/go-build857-I -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name /tmp/go-build857-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

When ANTHROPIC_BASE_URL/OPENAI_BASE_URL/GITHUB_COPILOT_BASE_URL is a GHA
expression (e.g., `${{ vars.ANTHROPIC_BASE_URL }}`), extractAPITargetHost
cannot detect `://` at compile time. It passes the expression verbatim as
--anthropic-api-target. At runtime the expression resolves to a full URL;
the API proxy receives it where it expects a bare hostname and constructs
`https://https://my-gateway.example.com` → 403.

Hardcoded URLs are unaffected — extractAPITargetHost strips the scheme
correctly at compile time.

Changes:
- isEnvVarExpression() — detects when an engine.env var is a GHA expression
- buildExpressionAPITargetArgs() — for each expression-based API target env
  var, returns a shell preamble that strips https://http:// and the path
  suffix via Bash parameter expansion, plus an expandable AWF arg
  referencing the resulting shell variable
- BuildAWFArgs() — skips expression-based targets from the static args list
- BuildAWFCommand() — calls buildExpressionAPITargetArgs() and splices the
  preamble before the awf invocation; unified PathSetup + API-target
  preamble into a single code path

Fixes stalled Copilot branch copilot/fix-duplicate-https-scheme (14
consecutive failures, PR #25250 closed as draft).

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/5b855c4c-a7b0-4acc-9052-5606bdd5e296

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Investigate stalled Copilot branch copilot/fix-duplicate-https-scheme fix: strip URL scheme from expression-based API targets at runtime Apr 8, 2026
Copilot AI requested a review from pelikhan April 8, 2026 16:07
@pelikhan pelikhan closed this Apr 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[deep-report] Investigate stalled Copilot branch copilot/fix-duplicate-https-scheme (14 consecutive failures)

2 participants