Skip to content

fix: restore GITHUB_API_URL in agent container when api-proxy is enabled #1420

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lpcox merged 2 commits into from
Mar 24, 2026
Merged

fix: restore GITHUB_API_URL in agent container when api-proxy is enabled #1420

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fbbe2be
Initial plan
Copilot Mar 24, 2026
4ee85de
fix: restore GITHUB_API_URL in agent container when api-proxy is enabled
Copilot Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions src/docker-manager.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2025,10 +2025,10 @@ describe('docker-manager', () => {
}
});

it('should not leak GITHUB_API_URL to agent when api-proxy is enabled with envAll', () => {
// When api-proxy is enabled, GITHUB_API_URL must be excluded so the Copilot CLI
// routes token exchange through COPILOT_API_URL → api-proxy (not directly to api.github.com
// with the placeholder COPILOT_GITHUB_TOKEN, which would cause a 401).
it('should pass GITHUB_API_URL to agent when api-proxy is enabled with envAll', () => {
// GITHUB_API_URL must remain in the agent environment even when api-proxy is enabled.
// The Copilot CLI needs it to locate the GitHub API (token exchange, user info, etc.).
// Copilot-specific calls route through COPILOT_API_URL → api-proxy regardless.
// See: github/gh-aw#20875
const origUrl = process.env.GITHUB_API_URL;
process.env.GITHUB_API_URL = 'https://api.github.com';
Expand All @@ -2037,9 +2037,9 @@ describe('docker-manager', () => {
const result = generateDockerCompose(configWithProxy, mockNetworkConfigWithProxy);
const agent = result.services.agent;
const env = agent.environment as Record<string, string>;
// GITHUB_API_URL should NOT be passed to agent when api-proxy is enabled
expect(env.GITHUB_API_URL).toBeUndefined();
// COPILOT_API_URL should be set to route through the api-proxy
// GITHUB_API_URL should be passed to agent even when api-proxy is enabled
expect(env.GITHUB_API_URL).toBe('https://api.github.com');
// COPILOT_API_URL should also be set to route Copilot calls through the api-proxy
expect(env.COPILOT_API_URL).toBe('http://172.30.0.30:10002');
} finally {
if (origUrl !== undefined) {
Expand Down
22 changes: 9 additions & 13 deletions src/docker-manager.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -455,12 +455,10 @@ export function generateDockerCompose(
EXCLUDED_ENV_VARS.add('ANTHROPIC_API_KEY');
EXCLUDED_ENV_VARS.add('CLAUDE_API_KEY');
// COPILOT_GITHUB_TOKEN gets a placeholder (not excluded), protected by one-shot-token
// GITHUB_API_URL must be excluded so the Copilot CLI routes ALL requests (including
// token exchange) through COPILOT_API_URL → api-proxy, not directly to api.github.com.
// If GITHUB_API_URL is present, the CLI may call api.github.com/copilot_internal/v2/token
// with the placeholder COPILOT_GITHUB_TOKEN (bypassing the api-proxy injection), causing 401.
// GITHUB_API_URL is intentionally NOT excluded: the Copilot CLI needs it to know the
// GitHub API base URL. Copilot-specific API calls (inference and token exchange) go
// through COPILOT_API_URL → api-proxy regardless of GITHUB_API_URL being set.
// See: github/gh-aw#20875
EXCLUDED_ENV_VARS.add('GITHUB_API_URL');
}

// Start with required/overridden environment variables
Expand Down Expand Up @@ -590,14 +588,12 @@ export function generateDockerCompose(
if (process.env.XDG_CONFIG_HOME) environment.XDG_CONFIG_HOME = process.env.XDG_CONFIG_HOME;
// Enterprise environment variables — needed for GHEC/GHES Copilot authentication
if (process.env.GITHUB_SERVER_URL) environment.GITHUB_SERVER_URL = process.env.GITHUB_SERVER_URL;
// GITHUB_API_URL — only pass when api-proxy is NOT enabled.
// On GHES, workflows set GITHUB_API_URL to the GHES API endpoint (e.g., https://api.ghes-host).
// When api-proxy is enabled, Copilot CLI must use COPILOT_API_URL (pointing to the proxy)
// instead of GITHUB_API_URL, because the proxy correctly routes Copilot API requests to
// api.enterprise.githubcopilot.com (not the GHES API which lacks Copilot endpoints).
// GITHUB_API_URL is also excluded via EXCLUDED_ENV_VARS for the --env-all path.
// See: github/gh-aw#20875
if (process.env.GITHUB_API_URL && !config.enableApiProxy) environment.GITHUB_API_URL = process.env.GITHUB_API_URL;
// GITHUB_API_URL — always pass when set. The Copilot CLI needs it to locate the GitHub API
// (especially on GHES/GHEC where the URL differs from api.github.com).
// Copilot-specific API calls (inference and token exchange) always route through
// COPILOT_API_URL → api-proxy when api-proxy is enabled, so GITHUB_API_URL does not
// interfere with credential isolation.
if (process.env.GITHUB_API_URL) environment.GITHUB_API_URL = process.env.GITHUB_API_URL;
Comment on lines +591 to +596

Copilot AI Mar 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change makes GITHUB_API_URL available in the agent when --enable-api-proxy is on, but the integration test tests/integration/api-proxy.test.ts still asserts the opposite ("should exclude GITHUB_API_URL…"). That test will now fail in CI (Integration Tests workflow runs --testPathPatterns="api-proxy"), so it should be updated/renamed to reflect the new intended behavior (expect GITHUB_API_URL to be present).

Copilot uses AI. Check for mistakes.

// Auto-inject GH_HOST when GITHUB_SERVER_URL points to a GHES/GHEC instance
// This ensures gh CLI inside the agent container targets the correct GitHub instance
Expand Down
Loading