Route Daily Go Test Parallelizer GitHub operations through MCP proxy

[Copilot]

The workflow was generating direct GitHub API traffic, contributing to widespread firewall blocks and unreliable runs. GitHub operations now use the intended proxy path.

• Proxy configuration
  • Enable cli-proxy.
  • Configure GitHub tools with mode: gh-proxy.
• Compiled workflow
  • Regenerate the corresponding .lock.yml to apply the proxy topology.

tools:
  cli-proxy: true
  github:
    mode: gh-proxy

• Fixes [deep-report] Daily Go Test Parallelizer bypasses GitHub MCP proxy, causing 75% of fleet firewall blocks #58847

[github-actions]

Category: bug | Risk: medium | Score: 49 | Action: batch_review | Batch: workflow-reliability.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• api.github.com
• github.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "github.com"

See Network Configuration for more information.

Generated by 🔧 PR Triage Agent · copilot · mai10 · 24.4 AIC · ⌖ 2.76 AIC · ⊞ 16.5K · ◷

[github-actions]

⚠️ Security scanning failed for Ponytail Reviewer. Review the logs for details.

Lean already. Ship.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by Ponytail Reviewer for #58863

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel skipped.

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

No ADR enforcement needed: PR does not have the implementation label and has ≤100 new lines of code in business logic directories.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

[github-actions]

Comment Memory

reviewed_at: 2026-09-06T02:40:43Z
review_event: COMMENT
top_themes:
  - workflow now routes GitHub operations through cli-proxy
  - no blocking correctness or security regressions found in changed lines
files_reviewed:
  - .github/workflows/daily-go-test-parallelizer.md
  - .github/workflows/daily-go-test-parallelizer.lock.yml
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 32 AIC · ⌖ 7.33 AIC · ⊞ 21.8K · ◷
_{Comment /review to run again}

[github-actions]

Verdict

Non-blocking change. The workflow now switches GitHub operations onto the CLI proxy path, and I didn't find a changed-line regression that obviously breaks execution.

What I checked

• The workflow source enables cli-proxy and github.mode: gh-proxy, which matches the established pattern used by other proxied workflows in this repo.
• The generated lockfile adds the CLI proxy lifecycle (Start CLI Proxy / Stop CLI Proxy), injects the safeoutputs CLI prompt, and passes the DIFC proxy host/cert into the AWF invocation.
• The removed in-container GitHub MCP server wiring is intentional here rather than an accidental capability drop: the workflow prompt already expects GitHub reads through the pre-authenticated gh CLI path.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 32 AIC · ⌖ 7.33 AIC · ⊞ 21.8K
_{Comment /review to run again}

[Copilot]

🟢 Approval recommended

The reviewed proxy configuration and generated workflow changes have no unresolved issues.

Pull request overview

Routes the Daily Go Test Parallelizer’s GitHub operations through the authenticated CLI proxy to avoid firewall-blocked direct API traffic.

Changes:

• Enables cli-proxy and sets GitHub to gh-proxy mode.
• Regenerates the compiled workflow with proxy routing and cleanup.

File summaries

File	Description
.github/workflows/daily-go-test-parallelizer.md	Configures proxied GitHub access.
.github/workflows/daily-go-test-parallelizer.lock.yml	Applies the generated proxy topology.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Skills-Based Review 🧠

Applied /codebase-design (fallback heuristic used for skill selection since pr-triage returned only prose analysis, not the documented JSON shape).

This is a minimal, config-only change that routes the daily-go-test-parallelizer workflow's GitHub reads through the existing cli-proxy/github: mode: gh-proxy pattern, consistent with dozens of other workflows in this repo (ci-doctor.md, copilot-opt.md, contribution-check.md, etc.).

📋 Verification notes

• tools.cli-proxy: true + tools.github.mode: gh-proxy is an established, well-tested configuration path (pkg/workflow/github_mode_gh_proxy_integration_test.go, compiler_difc_proxy.go), not a novel abstraction — low architectural risk.
• The regenerated .lock.yml correctly reflects the source: removes the direct github MCP server container/guard env vars, adds the Start CLI Proxy / Stop CLI Proxy steps, updates the firewall topology (awmg-mcpg → awmg-mcpg, awmg-cli-proxy), and threads --difc-proxy-host/--difc-proxy-ca-cert into the awf invocation.
• No toolsets key is set on github:, so it falls back to the implicit default toolset (context,repos,issues,pull_requests), which matches the previous MCP server's GITHUB_TOOLSETS value and the workflow's existing issues: read / pull-requests: read permissions — behavior-preserving.
• No new abstractions, tests, or bug fixes are involved — the diff is a targeted frontmatter addition plus its compiled artifact, matching the pattern used elsewhere in the repo.

No actionable issues found. Approving.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 59.3 AIC · ⌖ 14.7 AIC · ⊞ 10.3K
_{Comment /matt to run again}