Conversation
…K mode Agent-Logs-Url: https://github.com/github/gh-aw/sessions/cab1822b-9d47-4c80-9166-b432577e6a73 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Document COPILOT_PROVIDER_* variables and update allowlist
fix: add COPILOT_PROVIDER_* to strict-mode allowlist and document Copilot BYOK mode
May 1, 2026
Collaborator
|
@copilot when the COPILOT_PROVIDER_API_KEY env var is set, do not attempt to validate the COPILOT_GITHUB_TOKEN in the validate step. |
Contributor
There was a problem hiding this comment.
Pull request overview
Enables Copilot BYOK (external provider) configuration by allowing COPILOT_PROVIDER_* secret-bearing variables through strict-mode validation, and documents how to use BYOK mode.
Changes:
- Allowlists
COPILOT_PROVIDER_BASE_URL,COPILOT_PROVIDER_API_KEY, andCOPILOT_PROVIDER_BEARER_TOKENin Copilot engine required secret names (to pass strict-mode env secret validation and env filtering). - Introduces named constants for the BYOK env var keys.
- Adds strict-mode test cases covering the BYOK env vars and mixed allowed+disallowed secrets.
- Documents Copilot BYOK mode, variables, and examples in engine reference docs.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/copilot_engine.go | Adds BYOK COPILOT_PROVIDER_* keys to the Copilot engine strict-mode/secret allowlist via GetRequiredSecretNames. |
| pkg/constants/engine_constants.go | Defines constants for BYOK provider env var names. |
| pkg/workflow/env_secrets_validation_test.go | Adds strict-mode tests validating the BYOK env vars are allowed (and unrelated secrets still fail). |
| docs/src/content/docs/reference/engines.md | Adds a BYOK mode section with variable reference table and configuration examples. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
docs/src/content/docs/reference/engines.md:254
- This note says other
COPILOT_PROVIDER_*variables “may also use${{ secrets.* }}syntax”. With strict-mode validation,${{ secrets.* }}references inengine.envare only permitted for the allowlisted credential keys; using secrets syntax for non-allowlisted provider config vars would still error. Please clarify (e.g., plain strings recommended; secrets syntax only works for the credential keys, or in non-strict mode).
> `COPILOT_PROVIDER_BASE_URL`, `COPILOT_PROVIDER_API_KEY`, and `COPILOT_PROVIDER_BEARER_TOKEN` are
> recognised as engine credentials and are allowed to carry `${{ secrets.* }}` references in
> `engine.env` without triggering the strict-mode "secrets in env" warning. Other
> `COPILOT_PROVIDER_*` variables (type, model, token limits) hold non-sensitive configuration and
> can be set as plain strings. They may also use `${{ secrets.* }}` syntax if you prefer to keep
- Files reviewed: 4/4 changed files
- Comments generated: 1
|
|
||
| The Copilot engine supports routing requests to an external LLM provider instead of GitHub's default routing. This is useful when you want to use a different model or provider (e.g., OpenAI, Anthropic, Azure OpenAI, or a local Ollama/vLLM instance) while still using the Copilot CLI tooling. | ||
|
|
||
| Set `COPILOT_PROVIDER_BASE_URL` in `engine.env` to activate BYOK mode. All `COPILOT_PROVIDER_*` secret variables are allowed in `engine.env` under strict mode — they are not leaked to the agent container. |
Contributor
🧪 Test Quality Sentinel ReportTest Quality Score: 66/100
Test Classification DetailsView all 5 test rows
Suggestions (Non-blocking)
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
…e allowlist Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
|
Commit pushed:
|
…als are set Agent-Logs-Url: https://github.com/github/gh-aw/sessions/d9b49ef2-5519-430d-a591-dadae0dae3ab Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Done in d98f29b. |
Copilot
AI
changed the title
fix: add COPILOT_PROVIDER_* to strict-mode allowlist and document Copilot BYOK mode
fix: add COPILOT_PROVIDER_* to strict-mode allowlist, skip token validation in BYOK mode, and document Copilot BYOK
May 1, 2026
Collaborator
|
@copilot review all comments |
…mode allowlisted Agent-Logs-Url: https://github.com/github/gh-aw/sessions/84d354ca-8822-4976-8584-2ab664b36dc3 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Addressed in 736b55a — the docs now explicitly list the three allowlisted variables ( |
Collaborator
…cluding BYOK constants Agent-Logs-Url: https://github.com/github/gh-aw/sessions/5ed16059-c8f5-4d09-8d5d-00ad34f529f8 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Fixed in 8fdf765. The CI failure was Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
COPILOT_PROVIDER_*variables for Copilot BYOK (external LLM provider) mode were blocked by strict-mode validation and entirely undocumented, making it impossible to configure an external provider without warnings or errors. Additionally, theCOPILOT_GITHUB_TOKENvalidation step would incorrectly run even when a BYOK provider credential was configured.Changes
Strict-mode allowlist (
copilot_engine.go) —COPILOT_PROVIDER_BASE_URL,COPILOT_PROVIDER_API_KEY, andCOPILOT_PROVIDER_BEARER_TOKENadded unconditionally toGetRequiredSecretNames. This lets${{ secrets.* }}references for these keys pass strict-mode validation inengine.envand flow throughFilterEnvForSecretsto the execution step.BYOK token validation skip (
copilot_engine_installation.go) —GetSecretValidationStepnow returns an empty step (skippingCOPILOT_GITHUB_TOKENvalidation) whenCOPILOT_PROVIDER_API_KEYorCOPILOT_PROVIDER_BEARER_TOKENis present inengine.env. In BYOK mode the external provider handles authentication, so requiring a GitHub token would break BYOK-only workflows.Helper (
engine_helpers.go) — AddedengineEnvHasKeyhelper for safely checking whether a key exists inengine.env.Constants (
engine_constants.go) — Named constants for the three BYOK secret-bearing env var names.Tests (
env_secrets_validation_test.go,secret_validation_test.go) — Five new cases covering each BYOK secret var individually, a full config, and mixed BYOK + unrelated secret (still fails); plus two cases verifying the validation skip whenCOPILOT_PROVIDER_API_KEYorCOPILOT_PROVIDER_BEARER_TOKENis set.Docs (
engines.md) — New "Copilot Bring Your Own Key (BYOK) Mode" section with full variable reference table and examples.Example
Credentials are isolated in the AWF API proxy sidecar and do not reach the agent container. When
COPILOT_PROVIDER_API_KEYorCOPILOT_PROVIDER_BEARER_TOKENis set, theCOPILOT_GITHUB_TOKENvalidation step is skipped automatically.