fix: restore `GH_HOST: github.com` pin on Install GitHub Copilot CLI step by Copilot · Pull Request #24321 · github/gh-aw

Copilot · 2026-04-03T14:10:03Z

A prior change removed the step-level GH_HOST: github.com override from the Install GitHub Copilot CLI step, causing a regression for GHES workflows that set a workflow-level env.GH_HOST—that host leaks into the install step and can break the Copilot CLI install/auth path.

Changes

pkg/workflow/copilot_installer.go: Re-adds GH_HOST: github.com to the env: block of both the standard and expression-version install step variants
pkg/workflow/copilot_installer_test.go: Flips assertions to require GH_HOST: github.com is present (was asserting its absence)
.github/workflows/*.lock.yml: All 183 workflow lock files recompiled

Result

Generated install step now looks like:

- name: Install GitHub Copilot CLI
  run: ${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh latest
  env:
    GH_HOST: github.com

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw Sc8KyN6c6 ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.0/x^remote\..*\.gh-resolved$ /usr/bin/git efaultBranchFromgit efaultBranchFromrev-parse ache/go/1.25.0/x--show-toplevel git (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git n-dir/node git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name 14074146/001' 14074146/001' 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --show-toplevel git /usr/bin/git runs/20260403-14npm rev-parse /usr/bin/git git rev-�� h ../../../.prettierignore git /usr/bin/git --show-toplevel 138985/b446/_tes-atomic /opt/hostedtoolc-bool git (http block)
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name --show-toplevel node /usr/bin/git --write **/*.cjs (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha user.email test@example.com /usr/bin/git b/workflows GO111MODULE x_amd64/compile git rev-�� --show-toplevel x_amd64/compile /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel /usr/bin/git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --get (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel git /usr/bin/gh --show-toplevel git /usr/bin/git gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq /usr/bin/git ature-branch.patgit /usr/bin/git /usr/bin/git git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -bool l /usr/bin/gh -errorsas -ifaceassert -nilfunc gh api k/gh-aw/gh-aw/pkg/cli --jq /usr/bin/git l -trimpath 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha echo "�� Formatting JSON files..." l /usr/bin/gcc tierignore rtcfg /usr/bin/git gcc -###�� -x c /usr/bin/infocmp - /bin/sh /usr/bin/git infocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha --show-toplevel git /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet --show-toplevel git n-dir/node /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linuremote.origin.url -ato�� 4235866801 -buildtags /usr/bin/git l -ifaceassert -nilfunc git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha g_.a F1F-K_BiU 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env ortcfg hmGu04qL0 ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linuorigin (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel sm_wasm.s /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git 5524894/b235/_pkgit bhj8/yVsZXSY1_TCrev-parse 5524894/b235=> git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git hKLl/9e4-90qIw2xgit -trimpath /opt/hostedtoolc--show-toplevel git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha .actor }}, Unsafe: ${{ secrets.TOKEN }} go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git Gitbranch_with_hgit Gitbranch_with_hrev-parse x_amd64/compile git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/TestHashStability_SameInputSameOutput3856510193/001/stability-test.md x_amd64/cgo /usr/bin/git -json GO111MODULE x_amd64/compile git init�� GOMODCACHE x_amd64/compile /usr/bin/git -json o x_amd64/compile git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git Onlymin-integritgit edcfg ache/go/1.25.0/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile /usr/bin/git 5524894/b001/_pkgit CSmS/XhNHF0JN8Jerev-parse 1/x64/bin/node git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.0 -c=4 -nolocalimports -importcfg /tmp/go-build2475524894/b242/importcfg -pack /home/REDACTED/go/pkg/mod/golang.org/x/text@v0.35.0/internal/language/compact/compact.go -o /tmp/go-build402-p o 64/bin/go -p main -lang=go1.25 go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha /tmp/shared-actions-test1893810371 rev-parse /usr/bin/git go1.25.0 -c=4 -nolocalimports git rev-�� --show-toplevel /tmp/go-build951138985/b437/_testmain.go /usr/bin/git -json GO111MODULE x_amd64/compile git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha 2353-40898/test-4235866801 ache/node/24.14.1/x64/bin/npm ache/node/24.14.1/x64/bin/node nly git /usr/bin/git ache/node/24.14.1/x64/bin/node 0349�� y git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel -tests r,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,disp--show-toplevel -json flow-12345 x_amd64/compile git rev-�� --show-toplevel MEyT6qO/ilPel1urx6TpxZ0rej1L /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/compile node (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel git /usr/bin/git ll 2>&1 git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha /tmp/TestHashConsistency_KeyOrdering967771096/001/test2.md git /usr/bin/git --show-toplevel nly /usr/bin/git git -C /tmp/gh-aw-test-runs/20260403-142353-40898/test-2520660133/.github/workflows config /usr/bin/git remote.origin.urgit git /usr/bin/git git (http block)
https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha h ../../../.pret.prettierignore git de k/gh-aw/gh-aw/.g/bin/sh git ache/node/24.14.echo "Syncing actions-lock.json from .github/aw to pkg/workflow/data/action_pins.json..." gh api /repos/actions/github-script/git/ref/tags/v8 --jq (http block)
https://api.github.com/repos/github/gh-aw
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility on' --ignore-pat-f ache/node/24.14.owner=github odules/npm/node_-f --show-toplevel git e/git wc -l ./../pkg/workflow/js/**/*.json' --ignore-path e/git r: $owner, name: $name) { hasDiscussionsEnabled } } --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha /tmp/TestHashStability_SameInputSameOutput3856510193/001/stability-test.md -goversion /usr/bin/git -c=4 -nolocalimports -importcfg git init�� /home/REDACTED/work/gh-aw/gh-aw/pkg/sliceutil/sliceutil.go /home/REDACTED/work/gh-aw/gh-aw/pkg/sliceutil/sliceutil_test.go /opt/hostedtoolcache/node/24.14.1/x64/bin/node -json GO111MODULE x_amd64/compile node (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha /tmp/TestGuardPolicyMinIntegrityOnlyrepos_only_without_min-integrity723353054/001 rev-parse /usr/bin/git --show-toplevel /opt/hostedtoolcrev-parse /usr/bin/git git -C /tmp/gh-aw-test-runs/20260403-142353-40898/test-4118709269 rev-parse /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha licyBlockedUsersApprovalLabelsCompiledOutput1600159969/001 -trimpath ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -p github.com/goccyrev-parse -lang=go1.21 ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile test�� 138985/b436/_pkg_.a -parallel=4 1/x64/bin/node -run=^Test b/gh-aw/pkg/strirev-parse -short 1/x64/bin/node (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha --noprofile git /home/REDACTED/work/node_modules/.bin/node --show-toplevel e/git /usr/bin/git node /hom�� --write **/*.cjs /home/REDACTED/work/gh-aw/gh-aw/actions/node_modules/.bin/sh **/*.json --ignore-path ../../../.pretti--show-toplevel sh (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha ExpressionCompiledOutput1755421912/001 git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha licyMinIntegrityOnlyCompiledOutput511607969/001 -trimpath ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile l encoding/gob -lang=go1.25 ache/go/1.25.0/x64/pkg/tool/linux_amd64/compile -c 138985/b433/_pkg_.a MDJsnbUU_-r65gtyzUS-/MDJsnbUU_-r65gtyzUS- 1/x64/bin/node -goversion b/gh-aw/pkg/slicrev-parse -c=4 1/x64/bin/node (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --noprofile git /home/REDACTED/work/gh-aw/gh-aw/node_modules/.bin/node --show-toplevel (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha CommaSeparatedCompiledOutput2049430873/001 git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� 2353-40898/test-3538599575/.github/workflows git /usr/bin/git --show-toplevel git /usr/bin/gh git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a 0/internal/language/compact/compact.go 64/pkg/tool/linux_amd64/compile GOINSECURE .o 64/src/internal/--show-toplevel 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 git clusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --show-toplevel ache/go/1.25.0/xrev-parse /usr/bin/git ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet --no�� --noprofile git /node_modules/.bin/node --show-toplevel e/git /usr/bin/git node (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 git /usr/bin/git --show-toplevel git 64/bin/node git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 git on rkflow/js/**/*.jgit ache/go/1.25.0/xrev-parse erignore git rev-�� --show-toplevel =main /usr/local/bin/sh ./../.prettieriggit 64/pkg/tool/linurev-parse /usr/bin/git sh (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 /usr/bin/git /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -v git 86_64/node /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -ato�� 4235866801 -buildtags /bin/sh -errorsas -ifaceassert -nilfunc /bin/sh (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a 0/internal/tag/tag.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuTest User (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 git on rkflow/js/**/*.jgit 5RA9wNgZqMvUKjy3rev-parse erignore git rev-�� faultBranchFromLsRemoteWithRealGitmain_branch3988883066/001 faultBranchFromLsRemoteWithRealGitmain_branch3988883066/002/work /usr/sbin/sh ./../.prettieriggit e/git /usr/bin/git sh (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 /usr/bin/git /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet --get-regexp ^remote\..*\.gh-rev-parse /usr/bin/git /opt/hostedtoolcache/go/1.25.0/xTest User -ato�� -bool -buildtags /usr/lib/git-core/git-upload-pack -errorsas -ifaceassert -nilfunc git-upload-pack (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env 3764782452/.github/workflows r6s2JNrEV 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linuremote.origin.url (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 git ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet --show-toplevel ache/go/1.25.0/xrev-parse ode-gyp-bin/node--show-toplevel ache/go/1.25.0/x64/pkg/tool/linuTest User --no�� --noprofile git /home/REDACTED/work/_temp/uv-python-dir/node --show-toplevel /usr/lib/sysstatrev-parse /usr/bin/git node (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 git /usr/bin/git --show-toplevel git 86_64/node git conf�� licyBlockedUsersCommaSeparatedCompiledOutput2049430873/001 test@example.com /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env 3764782452/.github/workflows rotocol/go-sdk@v1.4.1/internal/util/net.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 git /home/REDACTED/.cargo/bin/bash --show-toplevel ache/go/1.25.0/xrev-parse /usr/bin/git bash --no�� --noprofile =master /opt/hostedtoolcache/node/24.14.1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/n--show-toplevel --show-toplevel /opt/hostedtoolcrev-parse /usr/bin/git node (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 git At,event,headBranch,headSha,displayTitle --show-toplevel git n-dir/node git rev-�� --show-toplevel git /usr/bin/gh --show-toplevel git /usr/bin/git gh (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env 2417112983/.github/workflows til.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 git /usr/local/.ghcup/bin/bash --show-toplevel ache/go/1.25.0/xrev-parse /usr/bin/git bash --no�� faultBranchFromLsRemoteWithRealGitmaster_branch2937316942/001 faultBranchFromLsRemoteWithRealGitmaster_branch2937316942/002/work /opt/hostedtoolcache/uv/0.11.3/x86_64/node --show-toplevel /opt/hostedtoolcrev-parse /usr/bin/git node (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 poll/fd.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a 0/language/coverage.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 git e/git-upload-pack heckout/git/ref/git ache/go/1.25.0/xrev-parse /usr/bin/git bash faul�� --noprofile git /home/REDACTED/go/bin/node --show-toplevel /opt/hostedtoolcrev-parse /usr/bin/git node (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 gh /usr/bin/git download 12345 /usr/bin/git git conf�� licyBlockedUsersCommaSeparatedCompiledOutput2049430873/001 Test User /usr/bin/git l git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path /tmp/go-build402-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE r1aaYBq/ZRJ039Evrev-parse (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/compile env g_.a GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/asm /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git g_.a GO111MODULE 64/pkg/tool/linu--verify git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha /usr/bin/gh git /usr/bin/git --show-toplevel gh 86_64/sh git rev-�� --show-toplevel git /usr/bin/git '**/*.ts' '**/*.git git ndor/bin/sh git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel git /opt/hostedtoolcache/node/24.14.1/x64/bin/node --show-toplevel git /usr/bin/git /opt/hostedtoolcache/node/24.14.1/x64/bin/node /tmp�� github.event.inputs.branch git /usr/bin/git initial.txt git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env g_.a GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD abis 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha re --log-level=e!../../../pkg/workflow/js/**/*.json infocmp /usr/bin/git xterm-color go /opt/hostedtoolc--bare git rev-�� js/**/*.json' --ignore-path ../../../.prettierignore /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git -unreachable=falgit /tmp/go-build951rev-parse /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha --show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git --noprofile git /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel node /usr/bin/git --write **/*.cjs (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE 5PMstAY/Tpa1yqzTrev-parse (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha w/js/**/*.json' --ignore-path git /home/REDACTED/.local/bin/node --show-toplevel -tests /usr/bin/git node /opt�� install --package-lock-o--all /usr/bin/git GOMODCACHE x_amd64/compile /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha --show-toplevel gh /usr/bin/git /repos/nonexistegit --jq /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/cgo GOINSECURE GOMOD GOMODCACHE x_amd64/cgo env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha js/**/*.json' --ignore-path ../../../.prettierignore ache/node/24.14.1/x64/bin/node /usr/bin/git --show-toplevel -goversion /usr/bin/git git _bra�� --show-toplevel git es/.bin/node add origin /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git rev-�� ay_c944679791/001 git /usr/bin/git --show-toplevel node /usr/bin/git git (http block)
https://api.github.com/repos/githubnext/agentics/git/ref/tags/
- Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha w/js/**/*.json' --ignore-path 'origin' $name) { hasDiscussionsEnabled } } /tmp/TestHashCongit git /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha -json GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env b/workflows GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE .o 64/src/runtime/asteps.test.outputs.result 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha re --log-level=e!../../../pkg/workflow/js/**/*.json git /prettier --show-toplevel go /usr/bin/git git rev-�� --show-toplevel git ode_modules/.bin/sh --show-toplevel resolved$ /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha REDACTED REDACTED /usr/bin/git --noprofile git /node_modules/.b--show-toplevel git rev-�� --show-toplevel node /usr/bin/git --write **/*.cjs (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE EOnrZZT/kdGN-541E03IKOxFokRP env y_only_defaults_repo4122158014/001 TnWrhVDeN ache/go/1.25.0/x64/bin/go GOINSECURE tants GOMODCACHE r (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --show-toplevel 64/pkg/tool/linurev-parse /usr/bin/git node /hom�� --write **/*.cjs 572416/b436/vet.cfg **/*.json --ignore-path ../../../.pretti--show-toplevel node (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion l ache/go/1.25.0/xrev-parse /usr/bin/git node /tmp�� /tmp/TestHashConsistency_GoAndJavaScript1218671379/001/test-frontmatter-with-nested-objects.md git /usr/bin/git --show-toplevel node /usr/bin/gh git (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go -p main -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo /node runs/20260403-14node rev-parse /usr/bin/git git /pre�� --show-toplevel git /usr/bin/git /tmp/go-build951/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -pack /opt/hostedtoolc-bool git (http block)
https://api.github.com/repos/owner/repo/contents/file.md
- Triggering command: /tmp/go-build951138985/b396/cli.test /tmp/go-build951138985/b396/cli.test -test.testlogfile=/tmp/go-build951138985/b396/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -importcfg /tmp/go-build2475524894/b215/importcfg -pack /home/REDACTED/go/pkg/mod/github.com/segmentio/asm@v1.1.3/base64/base64.go -o /tmp/go-build402-p -trimpath 64/bin/go -p main -lang=go1.25 go (http block)
- Triggering command: /tmp/go-build967572416/b396/cli.test /tmp/go-build967572416/b396/cli.test -test.testlogfile=/tmp/go-build967572416/b396/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true /tmp/TestParseDesh /tmp/TestParseDe-c /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel s/test.md /tmp/go-build951npx prettier --write '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' --ignore-path git (http block)
- Triggering command: /tmp/go-build697611856/b373/cli.test /tmp/go-build697611856/b373/cli.test -test.testlogfile=/tmp/go-build697611856/b373/testlog.txt -test.paniconexit0 -test.v=true -test.timeout=2m0s -test.run=^Test ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /usr/bin/git 4291838001 git /home/REDACTED/wor--show-toplevel git rev-�� --show-toplevel sh /usr/bin/git runs/20260403-14git git epo.git git (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name /tmp/go-build402-p -trimpath 64/bin/go -p github.com/githu-o -lang=go1.25 go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD e_wasm.s go (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel git /usr/bin/git uUO-/eLM037YCggQ/bin/sh -tests ache/node/24.14.echo "�� Formatting JSON files..." git rev-�� h ../../../.prettierignore 138985/b445/importcfg /usr/bin/git k/gh-aw/gh-aw/.ggcc k/gh-aw/gh-aw/pk-### /opt/hostedtoolc-x git (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name --show-toplevel sh /usr/bin/git "prettier" --wrigit git /home/REDACTED/nod--show-toplevel git rev-�� --show-toplevel node ache/uv/0.11.3/x86_64/node prettier --write /usr/bin/git git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/6bb41965-2c8d-4f9f-a48a-6665d1de9155 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Restores a step-level GH_HOST: github.com pin on the generated “Install GitHub Copilot CLI” workflow step to prevent workflow-level GH_HOST (common on GHES) from affecting that install step.

Changes:

Re-add env: GH_HOST: github.com to both the standard and expression-based Copilot CLI install step variants.
Update unit tests to assert GH_HOST: github.com is present in generated install steps.
Recompile workflow lockfiles so the install step includes the pinned GH_HOST.

Reviewed changes

Copilot reviewed 125 out of 125 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/workflow/copilot_installer.go	Re-adds step-level `GH_HOST: github.com` to generated Copilot CLI install steps.
pkg/workflow/copilot_installer_test.go	Updates assertions to require `GH_HOST: github.com` in generated steps.
.github/workflows/workflow-skill-extractor.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/workflow-normalizer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/workflow-health-manager.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/workflow-generator.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/weekly-safe-outputs-spec-review.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/weekly-issue-summary.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/weekly-editors-health-check.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/weekly-blog-post-writer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/video-analyzer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/update-astro.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/ubuntu-image-analyzer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/tidy.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/test-workflow.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/test-project-url-default.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/test-dispatcher.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/terminal-stylist.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/technical-doc-writer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/super-linter.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/sub-issue-closer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/stale-repo-identifier.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/smoke-workflow-call.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/smoke-workflow-call-with-inputs.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/smoke-update-cross-repo-pr.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/smoke-test-tools.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/smoke-temporary-id.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/smoke-service-ports.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/smoke-project.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/smoke-multi-pr.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/smoke-create-cross-repo-pr.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/smoke-copilot.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/smoke-copilot-arm.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/slide-deck-maintainer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/security-review.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/security-compliance.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/research.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/repository-quality-improver.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/repo-tree-map.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/repo-audit-analyzer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/release.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/refiner.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/q.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/python-data-charts.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/pr-triage-agent.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/pr-nitpick-reviewer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/portfolio-analyst.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/poem-bot.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/plan.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/pdf-summary.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/org-health-report.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/notion-issue-summary.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/metrics-collector.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/mergefest.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/mcp-inspector.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/layout-spec-maintainer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/jsweep.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/issue-triage-agent.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/issue-monster.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/hourly-ci-cleaner.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/gpclean.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/glossary-maintainer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/github-remote-mcp-auth-test.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/functional-pragmatist.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/firewall.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/firewall-escape.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/example-permissions-warning.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/draft-pr-cleanup.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/docs-noob-tester.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/discussion-task-miner.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/dictation-prompt.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/dev.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/dev-hawk.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/dependabot-go-checker.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/dependabot-burner.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/delight.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/dead-code-remover.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-workflow-updater.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-testify-uber-super-expert.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-team-status.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-syntax-error-quality.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-semgrep-scan.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-secrets-analysis.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-safe-output-integrator.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-repo-chronicle.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-regulatory.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-performance-summary.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-news.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-mcp-concurrency-analysis.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-malicious-code-scan.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-integrity-analysis.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-firewall-report.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-file-diet.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-copilot-token-report.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-compiler-quality.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-community-attribution.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-cli-tools-tester.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-cli-performance.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-assign-issue-to-user.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/daily-architecture-diagram.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/craft.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/copilot-token-usage-analyzer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/copilot-token-optimizer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/copilot-pr-prompt-analysis.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/copilot-pr-nlp-analysis.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/copilot-pr-merged-report.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/copilot-cli-deep-research.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/contribution-check.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/constraint-solving-potd.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/code-simplifier.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/code-scanning-fixer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/cli-consistency-checker.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/claude-token-usage-analyzer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/claude-token-optimizer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/ci-coach.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/breaking-change-checker.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/brave.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/bot-detection.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/auto-triage-issues.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/artifacts-summary.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/archie.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/agentic-observability-kit.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/agent-persona-explorer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/agent-performance-analyzer.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.
.github/workflows/ace-editor.lock.yml	Lockfile regeneration to add `GH_HOST: github.com` under the Copilot install step.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-03T14:38:45Z

pkg/workflow/copilot_installer.go

+	// The script downloads the Copilot CLI using curl with hardcoded github.com URLs.
+	//
+	// GH_HOST is pinned to github.com at the step level to prevent any workflow-level
+	// env.GH_HOST (common on GHES deployments) from leaking into this step and
+	// interfering with the Copilot CLI install/auth path, which requires github.com.


The rationale comment for pinning GH_HOST looks inconsistent with the current installer script. actions/setup/sh/install_copilot_cli.sh downloads from hardcoded https://github.com/... URLs and does not reference GH_HOST, so setting GH_HOST: github.com in this step won’t affect the install path. Either update the comment to reflect that this pin is purely defensive/future-proofing, or point to the concrete code path that actually consults GH_HOST (and ensure the pin is applied there).

Copilot · 2026-04-03T14:38:45Z

pkg/workflow/copilot_installer_test.go

 			expectedVersion: "v0.0.370",
 			shouldContain: []string{
 				"${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh v0.0.370",
+				"GH_HOST: github.com", // Must pin GH_HOST to prevent GHES workflow-level overrides
 			},
 			shouldNotContain: []string{
 				"gh.io/copilot-install | sudo bash",
-				"GH_HOST: github.com", // Should not hardcode GH_HOST (breaks GHEC)
 			},


The tests now require GH_HOST: github.com for the non-expression variants, but TestGenerateCopilotInstallerSteps_ExpressionVersion still doesn’t assert that GH_HOST is present. Since this PR adds the pin for both branches, it would be good to add an assertion in the expression-version test as well to prevent regressions specific to ${{ ... }} versions.

Initial plan

5c2ac47

Copilot AI assigned Copilot and pelikhan Apr 3, 2026

Copilot started work on behalf of pelikhan April 3, 2026 14:10 View session

Copilot AI linked an issue Apr 3, 2026 that may be closed by this pull request

Suspected regression in v0.65.6: Install GitHub Copilot CLI no longer emits GH_HOST: github.com #24259

Closed

fix: restore GH_HOST: github.com pin on Install GitHub Copilot CLI step

5c2d7c2

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/6bb41965-2c8d-4f9f-a48a-6665d1de9155 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix regression in GH_HOST emission for Install GitHub Copilot CLI~~ fix: restore GH_HOST: github.com pin on Install GitHub Copilot CLI step Apr 3, 2026

Copilot AI requested a review from pelikhan April 3, 2026 14:30

Copilot finished work on behalf of pelikhan April 3, 2026 14:30

pelikhan marked this pull request as ready for review April 3, 2026 14:33

Copilot AI review requested due to automatic review settings April 3, 2026 14:33

Copilot started reviewing on behalf of pelikhan April 3, 2026 14:34 View session

Copilot AI reviewed Apr 3, 2026

View reviewed changes

pelikhan merged commit b3c60d2 into main Apr 3, 2026
65 of 67 checks passed

pelikhan deleted the copilot/fix-gh-host-emission-issue branch April 3, 2026 14:40

lpcox mentioned this pull request Apr 3, 2026

Suspected regression in v0.65.6: Install GitHub Copilot CLI no longer emits GH_HOST: github.com #24259

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: restore `GH_HOST: github.com` pin on Install GitHub Copilot CLI step#24321

fix: restore `GH_HOST: github.com` pin on Install GitHub Copilot CLI step#24321
pelikhan merged 2 commits intomainfrom
copilot/fix-gh-host-emission-issue

Copilot AI commented Apr 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Copilot AI Apr 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Result

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 3, 2026 •

edited

Loading