fix: restore GITHUB_API_URL in agent container when api-proxy is enabled by Copilot · Pull Request #1420 · github/gh-aw-firewall

Copilot · 2026-03-24T20:22:53Z

Commit 5a56789 incorrectly excluded GITHUB_API_URL from the agent container when --enable-api-proxy is active, causing the Copilot CLI to fail immediately with "Authentication failed". The Copilot CLI needs GITHUB_API_URL to locate the GitHub API; it already routes Copilot-specific calls (token exchange, inference) through COPILOT_API_URL → api-proxy regardless.

Evidence

Comparing the failing branch against a successful run (worktree-audit-observability):

	`GITHUB_API_URL` in container	Result
Successful run	✅ present	Authenticated, ran ~4.5 min
Failing runs (×3)	❌ excluded	Failed in 1.24s with "Authentication failed"

Changes

src/docker-manager.ts: Remove EXCLUDED_ENV_VARS.add('GITHUB_API_URL') from the api-proxy block; make the GITHUB_API_URL forwarding unconditional (matches the working pre-regression behavior):
```
- if (process.env.GITHUB_API_URL && !config.enableApiProxy) environment.GITHUB_API_URL = ...;
+ if (process.env.GITHUB_API_URL) environment.GITHUB_API_URL = ...;
```
src/docker-manager.test.ts: Flip the expectation — GITHUB_API_URL should be present even when api-proxy is enabled, alongside COPILOT_API_URL.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/github/gh-aw-firewall/actions/jobs/68429069221
- Triggering command: /usr/bin/gh gh run view 23510263213 --log --job 68429069221 (http block)
https://api.github.com/repos/github/gh-aw-firewall/actions/runs/23510263213/artifacts
- Triggering command: /usr/bin/gh gh run download 23510263213 --name agent-artifacts --dir /tmp/agent-artifacts-run (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Fix the failing GitHub Actions workflow agent
Analyze the workflow logs, identify the root cause of the failure, and implement a fix.
Job ID: 68429069221
Job URL: https://github.com/github/gh-aw-firewall/actions/runs/23510263213/job/68429069221

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Root cause: commit 5a56789 excluded GITHUB_API_URL from the agent container when api-proxy is enabled, based on the incorrect theory that its presence would cause the Copilot CLI to route token exchange through api.github.com with the placeholder token. Evidence from CI logs: successful runs (worktree-audit-observability) had GITHUB_API_URL present and worked; all failing runs lacked it and failed immediately with "Authentication failed" after ~1.2 seconds. The Copilot CLI needs GITHUB_API_URL to locate the GitHub API. Its Copilot-specific calls (token exchange, inference) already route through COPILOT_API_URL → api-proxy regardless of GITHUB_API_URL being set. Fix: - Remove EXCLUDED_ENV_VARS.add('GITHUB_API_URL') from api-proxy block - Change conditional GITHUB_API_URL assignment to unconditional - Update test to expect GITHUB_API_URL present even with api-proxy enabled Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/db4a1afe-02b9-43f2-bfae-41febbcbc8b5

Copilot

Pull request overview

Restores forwarding of GITHUB_API_URL into the agent container even when --enable-api-proxy is enabled, fixing Copilot CLI authentication regressions caused by removing that env var from the container environment.

Changes:

Stop excluding GITHUB_API_URL from the agent environment when api-proxy is enabled.
Make GITHUB_API_URL forwarding unconditional (when set) in generateDockerCompose.
Update the unit test expectation so GITHUB_API_URL is present alongside COPILOT_API_URL under --env-all.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/docker-manager.ts	Ensures `GITHUB_API_URL` is no longer excluded/conditionally forwarded when api-proxy is enabled.
src/docker-manager.test.ts	Updates unit test to expect `GITHUB_API_URL` to be present with api-proxy + `envAll`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-24T21:12:00Z

src/docker-manager.ts

+    // GITHUB_API_URL — always pass when set. The Copilot CLI needs it to locate the GitHub API
+    // (especially on GHES/GHEC where the URL differs from api.github.com).
+    // Copilot-specific API calls (inference and token exchange) always route through
+    // COPILOT_API_URL → api-proxy when api-proxy is enabled, so GITHUB_API_URL does not
+    // interfere with credential isolation.
+    if (process.env.GITHUB_API_URL) environment.GITHUB_API_URL = process.env.GITHUB_API_URL;


This change makes GITHUB_API_URL available in the agent when --enable-api-proxy is on, but the integration test tests/integration/api-proxy.test.ts still asserts the opposite ("should exclude GITHUB_API_URL…"). That test will now fail in CI (Integration Tests workflow runs --testPathPatterns="api-proxy"), so it should be updated/renamed to reflect the new intended behavior (expect GITHUB_API_URL to be present).

github-actions · 2026-03-25T12:55:24Z

🔮 The ancient spirits stir; the smoke run has been read in the stars.
PR titles: "fix: restore GITHUB_API_URL in agent container when api-proxy is enabled"; "fix: exclude GITHUB_API_URL from agent container when api-proxy is enabled"

GitHub MCP last 2 merged PRs: ✅
safeinputs-gh PR query: ❌ (tool unavailable)
Playwright github.com title contains "GitHub": ✅
Tavily search: ❌ (tool unavailable)
File write /tmp/gh-aw/agent/smoke-test-codex-23541734410.txt: ✅
Bash cat file verification: ✅
Discussion query + mystical discussion comment: ❌ (required tools unavailable)
npm ci && npm run build: ✅
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex

Warning

⚠️ Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "registry.npmjs.org"

See Network Configuration for more information.

….1.81+ (#1414) * fix: write apiKeyHelper to ~/.claude/settings.json for Claude Code v2.1.81+ Claude Code v2.1.81+ reads apiKeyHelper from ~/.claude/settings.json instead of ~/.claude.json. The entrypoint now writes to both paths for backward/forward compatibility. Fixes: github/gh-aw#22713 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * [WIP] Fix the failing GitHub Actions workflow agent (#1418) * Initial plan * fix: preserve existing claude config when merging apiKeyHelper Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/6efe3da1-78c0-44c2-b7ce-06b070ab91b8 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> * fix: exclude GITHUB_API_URL from agent container when api-proxy is enabled (#1419) * Initial plan * fix: exclude GITHUB_API_URL from agent container when api-proxy is enabled Regression introduced in commit 9761e87 (PR #1305) re-added an unconditional GITHUB_API_URL assignment that PR #1303 had fixed. Combined with the missing EXCLUDED_ENV_VARS entry for the --env-all code path, GITHUB_API_URL was leaking into the agent container when api-proxy is enabled. With GITHUB_API_URL present in the agent, the Copilot CLI routes its token exchange to api.github.com/copilot_internal/v2/token using the placeholder COPILOT_GITHUB_TOKEN instead of going through COPILOT_API_URL → api-proxy (which injects the real token), causing a 401 authentication failure. Fix: - Add GITHUB_API_URL to EXCLUDED_ENV_VARS when api-proxy is enabled (covers the --env-all path used by build-test.lock.yml) - Replace the duplicate unconditional assignment with the correct conditional version that was already present below it (from PR #1303) Tests: - should not leak GITHUB_API_URL to agent when api-proxy is enabled with envAll - should pass GITHUB_API_URL to agent when api-proxy is NOT enabled with envAll See: github/gh-aw#20875 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * fix: restore GITHUB_API_URL in agent container when api-proxy is enabled (#1420) * Initial plan * fix: restore GITHUB_API_URL in agent container when api-proxy is enabled Root cause: commit 5a56789 excluded GITHUB_API_URL from the agent container when api-proxy is enabled, based on the incorrect theory that its presence would cause the Copilot CLI to route token exchange through api.github.com with the placeholder token. Evidence from CI logs: successful runs (worktree-audit-observability) had GITHUB_API_URL present and worked; all failing runs lacked it and failed immediately with "Authentication failed" after ~1.2 seconds. The Copilot CLI needs GITHUB_API_URL to locate the GitHub API. Its Copilot-specific calls (token exchange, inference) already route through COPILOT_API_URL → api-proxy regardless of GITHUB_API_URL being set. Fix: - Remove EXCLUDED_ENV_VARS.add('GITHUB_API_URL') from api-proxy block - Change conditional GITHUB_API_URL assignment to unconditional - Update test to expect GITHUB_API_URL present even with api-proxy enabled Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/db4a1afe-02b9-43f2-bfae-41febbcbc8b5 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Initial plan

fbbe2be

Copilot AI assigned Copilot and lpcox Mar 24, 2026

Copilot started work on behalf of lpcox March 24, 2026 20:22 View session

Copilot AI changed the title ~~[WIP] Fix failing GitHub Actions workflow agent~~ fix: restore GITHUB_API_URL in agent container when api-proxy is enabled Mar 24, 2026

Copilot AI requested a review from lpcox March 24, 2026 20:51

Copilot finished work on behalf of lpcox March 24, 2026 20:51

lpcox marked this pull request as ready for review March 24, 2026 21:08

lpcox requested a review from Mossaka as a code owner March 24, 2026 21:08

Copilot AI review requested due to automatic review settings March 24, 2026 21:08

lpcox merged commit cfb3f33 into fix/claude-api-key-helper-settings-path Mar 24, 2026

lpcox deleted the copilot/fix-github-actions-workflow-agent branch March 24, 2026 21:08

Copilot started reviewing on behalf of lpcox March 24, 2026 21:08 View session

Copilot AI reviewed Mar 24, 2026

View reviewed changes

github-actions bot mentioned this pull request Mar 24, 2026

fix: write apiKeyHelper to ~/.claude/settings.json for Claude Code v2.1.81+ #1414

Merged

This comment has been minimized.

Sign in to view

This was referenced Mar 25, 2026

[Test Coverage] Add 100% test coverage for logs-audit command #1411

Merged

fix: allow host gateway traffic for localhost/Playwright #1435

Merged

fix: allow host service ports for GitHub Actions services containers #1436

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: restore GITHUB_API_URL in agent container when api-proxy is enabled#1420

fix: restore GITHUB_API_URL in agent container when api-proxy is enabled#1420
lpcox merged 2 commits intofix/claude-api-key-helper-settings-pathfrom
copilot/fix-github-actions-workflow-agent

Copilot AI commented Mar 24, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 24, 2026

Uh oh!

This comment has been minimized.

github-actions bot commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Evidence

Changes

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

github-actions bot commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 24, 2026 •

edited

Loading