Environment

• gh aw v0.58.1
• Agentic Workflow Firewall v0.24.1
• Repository hosted on GitHub Enterprise Server (GHES)
• Engine: GitHub Copilot CLI

Problem

When running agentic workflows on a GHES-hosted repository, the API proxy routes Copilot API requests (model listing, chat completions) to the GHES API endpoint (api.<ghes-host>) instead of the Copilot API (api.githubcopilot.com or api.enterprise.githubcopilot.com).

The Copilot CLI inside the agent container fails immediately with:

Error loading models: Error: Failed to list models: 400 Bad Request

0 turns, 0 token usage — the agent never starts a conversation.

Root Cause

The lock file passes GITHUB_API_URL: ${{ github.api_url }} to the agent job. On GHES, this resolves to https://api.<ghes-host>. The API proxy appears to use this as the upstream for all API requests, including Copilot model/chat requests.

Squid proxy access logs confirm the API proxy sent requests to the GHES API:

172.30.0.30:47750 api.<ghes-host>:443 CONNECT 200 TCP_TUNNEL:HIER_DIRECT
172.30.0.30:47762 api.<ghes-host>:443 CONNECT 200 TCP_TUNNEL:HIER_DIRECT

The Copilot models endpoint does not exist on the GHES API, so it returns 400.

Copilot CLI agent log

[DEBUG] Using COPILOT_API_URL from environment: http://172.30.0.30:10002
[ERROR] Request to GitHub API at http://172.30.0.30:10002/agents/swe/custom-agents/<org>/<repo>?... failed with status 404
[ERROR] Error loading models: Error: Failed to list models: 400 Bad Request
[ERROR] MCP transport for github closed
[DEBUG] runPromptMode: executePromptDirectly returned succeeded=false
[DEBUG] runPromptMode: exiting with code 1

Expected Behavior

The API proxy should route Copilot API requests (token exchange, model listing, chat completions) to the Copilot API service (api.githubcopilot.com / api.enterprise.githubcopilot.com), while using the GHES API URL (api.<ghes-host>) only for GitHub REST API calls.

Workaround

None known — this appears to require changes to the API proxy to distinguish between GitHub REST API and Copilot API routing on GHES.

Related

• add-wizard and add --create-pull-request fail to create PR on GitHub Enterprise Server repositories gh-aw#20875 (add-wizard fails to create PR on GHES repositories)