Add custom headers support for API Management integration by yg1996 · Pull Request #163 · actions/ai-inference

yg1996 · 2026-01-18T09:24:52Z

This change adds support for custom HTTP headers in AI inference requests, enabling integration with API Management platforms (Azure APIM, AWS API Gateway, Kong, etc.) and custom request routing/tracking.

Features:

New 'custom-headers' input supporting both YAML and JSON formats
Auto-detection of input format for better UX
Header name validation (alphanumeric, hyphens, underscores)
Automatic masking of sensitive headers in logs
Full backward compatibility (optional parameter)

Changes:

Added parseCustomHeaders() function in helpers.ts
Updated InferenceRequest interface with optional customHeaders field
Modified simpleInference() and mcpInference() to pass headers to OpenAI client
Added 18 comprehensive test cases
Updated documentation with examples and use cases

All 80 tests passing. Zero breaking changes.

This change adds support for custom HTTP headers in AI inference requests, enabling integration with API Management platforms (Azure APIM, AWS API Gateway, Kong, etc.) and custom request routing/tracking. Features: - New 'custom-headers' input supporting both YAML and JSON formats - Auto-detection of input format for better UX - Header name validation (alphanumeric, hyphens, underscores) - Automatic masking of sensitive headers in logs - Full backward compatibility (optional parameter) Changes: - Added parseCustomHeaders() function in helpers.ts - Updated InferenceRequest interface with optional customHeaders field - Modified simpleInference() and mcpInference() to pass headers to OpenAI client - Added 18 comprehensive test cases - Updated documentation with examples and use cases All 80 tests passing. Zero breaking changes.

Copilot

Pull request overview

This pull request adds support for custom HTTP headers in AI inference requests, enabling integration with API Management platforms (Azure APIM, AWS API Gateway, Kong, etc.) and custom request routing/tracking.

Changes:

New custom-headers input parameter supporting both YAML and JSON formats
Header parsing with auto-format detection and validation
Automatic masking of sensitive headers in logs
Full backward compatibility with optional parameter

Reviewed changes

Copilot reviewed 9 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
action.yml	Added `custom-headers` input definition with description
src/helpers.ts	Implemented `parseCustomHeaders()` function with validation and masking logic
src/inference.ts	Updated `InferenceRequest` interface and both inference functions to pass headers to OpenAI client
src/main.ts	Added parsing of custom headers input and passing to inference request
dist/index.js	Compiled JavaScript output with all changes
tests/helpers.test.ts	Added 12 comprehensive test cases for header parsing functionality
tests/inference.test.ts	Added 2 test cases verifying headers are passed to OpenAI client
tests/main.test.ts	Updated 2 existing tests to expect empty customHeaders object
README.md	Added comprehensive documentation with YAML/JSON examples and use cases
CUSTOM_HEADERS_FEATURE.md	New feature documentation file describing implementation details

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/helpers.ts

Address Copilot AI feedback: - Remove underscore support from header names (RFC 7230 compliance) - Add explicit null check for JSON parsing - Update validation regex to /^[A-Za-z0-9-]+$/ - Add test case for null value handling - Update documentation to clarify header name requirements Changes: - Header names now only accept alphanumeric characters and hyphens - Improved error messages for invalid headers - Added test for null JSON input - Updated APIM example tests All 81 tests passing.

Copilot

Pull request overview

Copilot reviewed 9 out of 11 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

README.md

Delete CUSTOM_HEADERS_FEATURE.md as the README.md already contains comprehensive documentation for the custom headers feature. This reduces documentation duplication and follows standard practice of keeping feature docs in the README.

Copilot

Pull request overview

Copilot reviewed 8 out of 10 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

README.md

src/helpers.ts

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 10 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

__tests__/helpers.test.ts

Copilot

Pull request overview

Copilot reviewed 8 out of 10 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

__tests__/helpers.test.ts

Implement security validation to prevent HTTP header injection attacks: - Reject header values containing \r or \n characters - Add comprehensive test coverage for CRLF protection - Replace multiline YAML test with proper rejection test Security improvements: - Validates header values to prevent header injection - Clear warning messages when values are rejected - Four new test cases covering LF, CR, CRLF, and multiline scenarios This addresses a critical security concern where malicious headers could be injected via newline characters in header values. All 84 tests passing.

Copilot

Pull request overview

Copilot reviewed 8 out of 10 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-18T10:23:34Z

__tests__/helpers.test.ts

+    it('validates header names and skips invalid ones', () => {
+      const yamlInput = `valid-header: value1
+invalid header: value2
+invalid_underscore: value3


The test expects invalid_underscore to be rejected, but this conflicts with the documentation claim that underscores are permitted per RFC 7230. If underscores should be allowed, update the regex validation and modify this test case to expect the header to be accepted.

Copilot

Pull request overview

Copilot reviewed 8 out of 10 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

yg1996

Seems there are no more changes needed.

yg1996 · 2026-01-18T12:37:42Z

Hi @actions/models team! 👋

I've implemented custom headers support for API Management integration (Azure APIM, AWS API Gateway, etc.). This feature:

✅ Fully backward compatible (optional parameter)
✅ RFC 7230 compliant header validation
✅ CRLF injection protection
✅ 84 tests passing with comprehensive coverage
✅ Sensitive data masking

The implementation addresses a common enterprise need for integrating with API Management platforms. Would appreciate your review when you have time!

Thanks for maintaining this great action! 🙏

sgoedecke · 2026-01-19T06:28:18Z

LGTM, thanks for submitting the PR.

yg1996 requested a review from a team as a code owner January 18, 2026 09:24

Copilot AI review requested due to automatic review settings January 18, 2026 09:24

Copilot started reviewing on behalf of yg1996 January 18, 2026 09:25 View session

Copilot AI reviewed Jan 18, 2026

View reviewed changes

src/helpers.ts Outdated Show resolved Hide resolved

src/helpers.ts Outdated Show resolved Hide resolved

yg1996 requested a review from Copilot January 18, 2026 09:36

Copilot started reviewing on behalf of yg1996 January 18, 2026 09:37 View session

Copilot AI reviewed Jan 18, 2026

View reviewed changes

README.md Outdated Show resolved Hide resolved

Remove redundant feature documentation file

c760995

Delete CUSTOM_HEADERS_FEATURE.md as the README.md already contains comprehensive documentation for the custom headers feature. This reduces documentation duplication and follows standard practice of keeping feature docs in the README.

yg1996 requested a review from Copilot January 18, 2026 09:45

Copilot started reviewing on behalf of yg1996 January 18, 2026 09:45 View session

Copilot AI reviewed Jan 18, 2026

View reviewed changes

README.md Outdated Show resolved Hide resolved

src/helpers.ts Show resolved Hide resolved

yg1996 and others added 2 commits January 18, 2026 11:58

Update README.md

6402ff8

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update src/helpers.ts

f773800

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

yg1996 requested a review from Copilot January 18, 2026 09:59

Copilot started reviewing on behalf of yg1996 January 18, 2026 10:00 View session

Copilot AI reviewed Jan 18, 2026

View reviewed changes

__tests__/helpers.test.ts Show resolved Hide resolved

__tests__/helpers.test.ts Outdated Show resolved Hide resolved

yg1996 requested a review from Copilot January 18, 2026 10:12

Copilot started reviewing on behalf of yg1996 January 18, 2026 10:13 View session

Copilot AI reviewed Jan 18, 2026

View reviewed changes

__tests__/helpers.test.ts Show resolved Hide resolved

yg1996 requested a review from Copilot January 18, 2026 10:20

Copilot started reviewing on behalf of yg1996 January 18, 2026 10:20 View session

Copilot AI reviewed Jan 18, 2026

View reviewed changes

yg1996 requested a review from Copilot January 18, 2026 11:28

Copilot started reviewing on behalf of yg1996 January 18, 2026 11:28 View session

Copilot AI reviewed Jan 18, 2026

View reviewed changes

yg1996 commented Jan 18, 2026

View reviewed changes

sgoedecke approved these changes Jan 19, 2026

View reviewed changes

sgoedecke merged commit a6101c8 into actions:main Jan 19, 2026
16 of 18 checks passed

Conversation

yg1996 commented Jan 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

yg1996 left a comment

Choose a reason for hiding this comment

Uh oh!

yg1996 commented Jan 18, 2026

Uh oh!

Uh oh!

sgoedecke commented Jan 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants