fix(workflow): preserve Copilot BYOK HTTP API targets by pelikhan · Pull Request #71680 · github/gh-aw

pelikhan · 2026-10-24T17:20:42Z

Summary

Copilot BYOK config generation stripped http:// from literal provider URLs, emitting host.docker.internal:11434 instead of http://host.docker.internal:11434. This loses the protocol information needed to route to HTTP backends such as Ollama.

Share Copilot target resolution and reuse the existing AWF HTTP capability gate, preserving HTTP only for the literal COPILOT_PROVIDER_BASE_URL fallback.
Keep GITHUB_COPILOT_BASE_URL host-only so GitHub-token-authenticated traffic does not switch to cleartext transport. Preserve explicit target precedence, expression handling, HTTPS behavior, legacy AWF compatibility, and host-only firewall allowlists.
Extract the literal provider host once, without a formatter callback or duplicate parsing.
Cover 15 config/allowlist cases, including non-BYOK HTTP base URLs and token injection/exclusion behavior. The generated Ollama lock already contains the HTTP scheme; models, firewall settings, and credit guards are unchanged.

ADR: ADR-71680: Preserve HTTP Only for Copilot BYOK Provider Targets

Validation

Targeted and broader Copilot/AWF config Go tests passed.
make fmt passed.
make agent-report-progress passed build, impacted tests, lint, schema checks, and compilation/drift checks for all 348 workflows.

Scope and uncertainty

The emitted-config bug is locally reproduced and fixed. Its socket-level role in the 503 failures from run 40033597616 remains unproven without the full upstream-error payload. No workflow was dispatched and no guard conditions were relaxed. The ADR remains Draft pending human acceptance.

Reuse version-gated API proxy target formatting while preserving Copilot target precedence, literal URL handling, and host-only allowlists. Regenerate the affected Ollama workflow lock and cover HTTP routing compatibility with regression tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-10-24T17:22:42Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

Commit pushed: 55245c6

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-10-24T17:22:44Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · sonnet50 · ~13 AIC · ⌖ ~16 AIC · ◇ ~5 AIC · ⊞ 12.7K · ◷

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-10-24T17:22:46Z

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · gpt56 · ~10 AIC · ⌖ ~7 AIC · ⊞ 14.8K · ◷

Generated by Ponytail Reviewer for #71680

github-actions · 2026-10-24T17:22:46Z

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-10-24T17:22:49Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-10-24T17:27:50Z

🏗️ Design Decision Gate — ADR Required

This PR adds more than 100 lines under pkg/ (151 additions, including the expanded table tests in pkg/workflow/awf_helpers_test.go), but it does not link an Architecture Decision Record (ADR).

📄 Draft ADR committed: docs/adr/71680-share-copilot-api-target-resolution-with-pluggable-host-formatter.md. Please review and finish it before merging.

Decision taken from the diff: the Copilot target precedence chain (explicit engine.api-target, then GITHUB_COPILOT_BASE_URL, then the literal BYOK COPILOT_PROVIDER_BASE_URL) moves into resolveCopilotAPITarget(workflowData, extractHost). That function takes the host formatter as a parameter. GetCopilotAPITarget keeps returning bare hosts. BuildAWFConfigJSON passes the version-gated extractAPIProxyTargetHost, so `(redacted) targets are kept for the API proxy.

🔒 This PR cannot merge until an ADR is linked in the PR body.

📋 What to do next

Review the draft ADR committed to your branch. It was generated from the PR diff.
Fill in what the draft could not infer, especially the items marked [TODO: verify] (deciders). Also refine the alternatives: always preserving the scheme in GetCopilotAPITarget, duplicating the precedence chain inline, or re-adding the scheme after the fact.
Commit the finished ADR to docs/adr/ on your branch.
Link the ADR in this PR body with a line such as:

ADR: ADR-71680: Share Copilot API Target Resolution with a Pluggable Host Formatter

After the ADR is linked in the PR body, this gate runs again and checks that the implementation matches the decision.

❓ Why ADRs Matter

ADRs give the repository a permanent, searchable record of why the code is shaped the way it is. That record helps future contributors, including you.

📋 Michael Nygard ADR Format Reference

An ADR is complete only when it has these four sections:

Context: What is the problem, and what constraints apply?
Decision: What did you decide, and why?
Alternatives Considered: What else could have been done?
Consequences: What are the trade-offs, positive and negative?

ADRs are stored in docs/adr/ as Markdown files named by PR number.

🏗️ ADR gate enforced by Design Decision Gate 🏗️ · pi · opus55 · ~28 AIC · ⌖ ~37 AIC · ⊞ 1.9K · ◷
_{Comment /review to run again}

github-actions · 2026-10-24T17:29:06Z

Comment Memory

Peek at saved memory (pr-code-quality-reviewer)

reviewed_at: 2026-10-24T17:27:00Z
review_event: REQUEST_CHANGES
top_themes:
  - stale generated lock file does not contain the new HTTP target
files_reviewed:
  - pkg/workflow/awf_config_build.go
  - pkg/workflow/engine_api_targets.go
  - pkg/workflow/awf_helpers_test.go
  - .github/workflows/daily-byok-ollama-test.lock.yml
comment_count: 1

Note

This comment is managed by comment memory.

Expand the saved memory block to view or edit the persistent context for this thread.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~4 AIC · ⌖ ~1 AIC · ⊞ 1.6K · ◷
_{Comment /review to run again}

github-actions

Request changes

The checked-in generated Ollama workflow is stale: its embedded AWF config still uses the bare host.docker.internal:11434 target, so this fix is not present in the workflow that will run and compile-drift validation is likely to fail. Regenerate and commit the lock file, then verify the emitted target includes `(redacted)

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt50 · ~4 AIC · ⌖ ~1 AIC · ⊞ 1.6K
_{Comment /review to run again}

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs and /tdd (via pr-triage: bug_fix) — approving. This is a well-diagnosed, well-tested fix.

📋 Key Themes & Highlights

Root cause and fix

Correctly identifies that extractAPITargetHost was stripping the (redacted) prefix needed by self-hosted BYOK backends (Ollama), and fixes it by introducing a scheme-preserving variant (extractAPIProxyTargetHost) that is version-gated behind AWFHTTPAPITargetMinVersion (awfSupportsHTTPAPITargets`).
resolveCopilotAPITarget cleanly shares the precedence logic (explicit api-target → GITHUB_COPILOT_BASE_URL → literal COPILOT_PROVIDER_BASE_URL) between the host-only allowlist consumer (GetCopilotAPITarget) and the API-proxy config builder, via an injected extractHost function — good use of dependency injection to avoid duplicating the precedence chain (/codebase-design deepening).

Test coverage (`/tdd`)

The regression suite grew from 1 assertion-based case to 14 table-driven cases, covering: HTTP preservation at/above/below the min AWF version, HTTPS and bare-host behavior (unchanged), explicit api-target and GITHUB_COPILOT_BASE_URL precedence over the BYOK URL, GitHub-expression values correctly rejected as literal targets, and a direct assertion that the firewall allowlist stays scheme-free (assert.NotContains(host, "://")) — this is exactly the kind of boundary-condition coverage /tdd calls for.
Test names read as specifications (e.g. "older AWF retains bare host and port", "GitHub HTTPS URL is not changed by HTTP provider URL").

Lock file

daily-byok-ollama-test.lock.yml diff is a single-line, single-field change (the copilot target host gains `(redacted) matching the PR description; firewall allowlist, models, and credit guards are untouched, as claimed.

Minor nit

Left one inline comment on engine_api_targets.go about the BYOK fallback looking up COPILOT_PROVIDER_BASE_URL twice (once to validate it's not a GitHub expression, once to extract the host) — purely cosmetic, non-blocking.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · ~56 AIC · ⌖ ~16 AIC · ⊞ 10.2K
_{Comment /matt to run again}

Copilot

🟡 Changes recommended

The expanded HTTP handling can transmit GitHub authentication tokens in cleartext outside BYOK mode.

1 open issue

Prevent cleartext Copilot token transmission for HTTP base URLs · New

What changed in this PR

Updates the gh-aw compiler to preserve HTTP schemes in Copilot API proxy targets while retaining host-only firewall allowlists and AWF version compatibility.

Changes:

Shares target resolution with consumer-specific formatting.
Expands regression coverage to 14 cases.
Regenerates the Ollama workflow configuration and documents the design.

File	Description
`pkg/workflow/engine_api_targets.go`	Extracts shared Copilot target resolution.
`pkg/workflow/awf_helpers_test.go`	Tests schemes, precedence, compatibility, and allowlists.
`pkg/workflow/awf_config_build.go`	Applies version-gated formatting to Copilot targets.
`docs/adr/71680-share-copilot-api-target-resolution-with-pluggable-host-formatter.md`	Records the design and alternatives.
`.github/workflows/daily-byok-ollama-test.lock.yml`	Preserves HTTP in the generated Ollama target.

_{Review effort: Max}

gh-aw-bot · 2026-10-24T18:02:16Z

@copilot address the following outstanding work in one pass:

Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
Review (pkg/workflow/awf_config_build.go:226): The generated Ollama lock still serializes the Copilot target as host.docker.internal:11434 rather than the `(host.docker.internal/redacted) this resolver now emits, so the committed workflow does not contain the fix and compile-drift/runtime validation will fail or continue using the broken target. - fix(workflow): preserve Copilot BYOK HTTP API targets #71680 (comment)
Review (pkg/workflow/engine_api_targets.go:198): [/codebase-design] Minor: the BYOK fallback now parses COPILOT_PROVIDER_BASE_URL twice per call — once via extractLiteralEngineEnvHost (to filter GitHub-expression values) and again via extractHost to get the actual host string. Both ultimately call extractAPITargetHost under the hood. - fix(workflow): preserve Copilot BYOK HTTP API targets #71680 (comment)
Review (pkg/workflow/engine_api_targets.go:188): When only GITHUB_COPILOT_BASE_URL=(redacted) is configured, this now emits an HTTP target outside BYOK mode, while the Copilot step still injects COPILOT_GITHUB_TOKEN`. AWF v0.28.70 uses that token for inference requests, so it now travels in cleartext instead of over HTTPS. Keep this branch host-only, reserve scheme preservation for the provider-URL fallback, and update the corresponding HTTP test expectation. - fix(workflow): preserve Copilot BYOK HTTP API targets #71680 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 55245c6
Sous-chef work: 46318e0845db266f968512743367ae6be57a2151e3b5850afa77a45a612f4137 6e0049970195f319fdf2812f2da465be5c65c74f7a4fb4ee831172c9779b95d5 ca9c677f3105210ffadcefd58fbf49c81fe905dc9a9b663c06b05dc3160f49dd
Sous-chef state: 444989909293eab8e4bc2e3021b73cda3fccc65886e0d01c3bf467da63552f11

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · ~13 AIC · ⌖ ~7 AIC · ⊞ 1.1K · ◷
_{Comment /souschef to run again}

Keep GitHub-token base URLs host-only, extract literal BYOK hosts once, and cover token handling and transport boundaries. Update the draft ADR to reflect the provider-only decision. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

pelikhan · 2026-10-24T18:15:21Z

In reply to this comment:

Accepted the ADR follow-up: reviewed and updated the generated draft in 973bf25 and linked it in the PR body. It now documents provider-only HTTP preservation and remains Draft pending human acceptance.

pelikhan · 2026-10-24T18:15:22Z

In reply to this comment:

Acknowledged; this status report requests no implementation change and is not being treated as proof of validation. The updated batch passed focused Copilot/config tests and make agent-report-progress, including compilation/drift checks for all 348 workflows.

pelikhan · 2026-10-24T18:15:24Z

In reply to this comment:

Acknowledged; no implementation change is requested by this status report. Validation of the updated batch was performed locally rather than inferred from the reported no-op outcome.

pelikhan · 2026-10-24T18:15:25Z

In reply to this comment:

Acknowledged the completed review and evaluated its inline finding separately. The stale-lock claim is already satisfied by the checked-in HTTP target, and all 348 workflows compile without lock drift.

pelikhan · 2026-10-24T18:15:27Z

In reply to this comment:

Accepted the associated simplification feedback in 973bf25: literal provider hosts are extracted once without a formatter callback. The remaining review notification requires no separate code change.

pelikhan · 2026-10-24T18:15:28Z

In reply to this comment:

Accepted: updated the ADR in 973bf25 and linked it in the PR body, replacing the unverified decider attribution with an explicit pending-human-review status. The decision and alternatives now match the simpler resolver and restrict HTTP preservation to literal BYOK provider targets.

pelikhan · 2026-10-24T18:15:30Z

In reply to this comment:

Declined the stale-lock finding as already satisfied: the checked-in Ollama target contains http://host.docker.internal:11434, and full compilation confirmed no drift. I left the bot-managed memory unchanged and replied directly to the associated review thread.

github-actions · 2026-10-25T06:44:11Z

🎉 This pull request is included in a new release.

Release: v0.93.4

pelikhan marked this pull request as ready for review October 24, 2026 17:21

Copilot AI max review requested due to automatic review settings October 24, 2026 17:21

Copilot started reviewing on behalf of pelikhan October 24, 2026 17:22

View session

docs(adr): add draft ADR-71680 for shared Copilot API target resolution

55245c6

github-actions Bot requested changes Oct 24, 2026

View reviewed changes

Comment thread pkg/workflow/awf_config_build.go Resolved

github-actions Bot approved these changes Oct 24, 2026

View reviewed changes

Comment thread pkg/workflow/engine_api_targets.go Resolved

Copilot AI reviewed Oct 24, 2026

View reviewed changes

Comment thread pkg/workflow/engine_api_targets.go Resolved

github-actions Bot mentioned this pull request Oct 24, 2026

[pr-sous-chef] Sous-chef action report #71525

Closed

Copilot started work on behalf of gh-aw-bot October 24, 2026 18:02

View session

pelikhan merged commit 9453692 into main Oct 24, 2026
64 checks passed

pelikhan deleted the pelikhan-symmetrical-succotash branch October 24, 2026 18:21

Copilot finished work on behalf of gh-aw-bot October 24, 2026 18:31

Copilot AI requested a review from gh-aw-bot October 24, 2026 18:31

Navigation Menu

Repository navigation

fix(workflow): preserve Copilot BYOK HTTP API targets - #71680

fix(workflow): preserve Copilot BYOK HTTP API targets#71680
pelikhan merged 3 commits into
mainfrom
pelikhan-symmetrical-succotash

pelikhan commented Oct 24, 2026 •

edited

Loading

github-actions Bot commented Oct 24, 2026 •

edited

Loading

github-actions Bot commented Oct 24, 2026 •

edited

Loading

github-actions Bot commented Oct 24, 2026 •

edited

Loading

github-actions Bot commented Oct 24, 2026 •

edited

Loading

github-actions Bot commented Oct 24, 2026 •

edited

Loading

github-actions Bot commented Oct 24, 2026

github-actions Bot commented Oct 24, 2026

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

gh-aw-bot commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

Uh oh!

github-actions Bot commented Oct 25, 2026

Uh oh!

Labels

4 participants

Conversation

pelikhan commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Scope and uncertainty

github-actions Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github-actions Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Quality Sentinel

github-actions Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Ponytail Reviewer

github-actions Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github-actions Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github-actions Bot commented Oct 24, 2026

🏗️ Design Decision Gate — ADR Required

github-actions Bot commented Oct 24, 2026

Comment Memory

github-actions Bot left a comment

Choose a reason for hiding this comment

Request changes

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Root cause and fix

Test coverage (/tdd)

Lock file

Minor nit

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

gh-aw-bot commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

pelikhan commented Oct 24, 2026

Uh oh!

github-actions Bot commented Oct 25, 2026

Uh oh!

Labels

4 participants

pelikhan commented Oct 24, 2026 •

edited

Loading

github-actions Bot commented Oct 24, 2026 •

edited

Loading

github-actions Bot commented Oct 24, 2026 •

edited

Loading

github-actions Bot commented Oct 24, 2026 •

edited

Loading

github-actions Bot commented Oct 24, 2026 •

edited

Loading

github-actions Bot commented Oct 24, 2026 •

edited

Loading

Test coverage (`/tdd`)