Extract shared auth-header builder for OpenAI and Copilot provider adapters by Copilot · Pull Request #8226 · github/gh-aw-firewall

Copilot · 2026-09-06T22:10:50Z

copilot.js and openai.js each reimplemented the same "custom header name vs. Authorization prefix" branching for credential injection, making security-sensitive auth logic harder to keep consistent across providers.

Shared helper

Added buildAuthHeaderFn({ headerName, prefix }) to containers/api-proxy/providers/auth-headers.js. Given a headerName it builds a providerKeyHeaders-style header (e.g. Azure BYOK's api-key); otherwise it falls back to tokenAuthHeaders with a configurable prefix (default Bearer), covering Copilot's token/Bearer split.

Adapter updates

openai.js: replaced the inline customAuthHeader ? providerKeyHeaders(...) : bearerAuthHeaders(...) branch with buildAuthHeaderFn({ headerName: customAuthHeader || undefined }).
copilot.js: replaced the tokenAuthHeaders(authPrefix, authToken, ...) call in buildStaticHeaders with buildAuthHeaderFn({ prefix: authPrefix })(...).

Tests

Added unit tests in auth-headers.test.js covering default prefix, custom prefix, header-name mode, and extra-header merging for both modes.

// before (openai.js)
function buildTokenAuthHeaders(key) {
  if (customAuthHeader) return providerKeyHeaders(customAuthHeader, key);
  return bearerAuthHeaders(key);
}

// after
const buildTokenAuthHeaders = buildAuthHeaderFn({ headerName: customAuthHeader || undefined });

No behavior change intended — this is a pure extraction of existing branching into one reusable, testable helper.

Fixes [Duplicate Code] Copilot and OpenAI provider auth setup repeats branching logic #8225

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

Copilot

🟡 Changes recommended

Remove the accidental temporary file and correct the helper’s misleading prefix documentation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 4/5 changed files
Comments generated: 1
Review effort level: Balanced

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

github-actions · 2026-09-07T14:22:17Z

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-09-07T14:27:29Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	93.97%	93.98%	📈 +0.01%
Statements	92.62%	92.63%	➡️ +0.01%
Functions	93.25%	93.25%	➡️ +0.00%
Branches	86.45%	86.47%	📈 +0.02%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/log-directory-setup.ts`	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

github-actions · 2026-09-07T14:42:01Z

📰 DEVELOPING STORY: Smoke Docker Sbx reports failed. Our correspondents are investigating the incident...

📰 BREAKING: Report filed by Smoke Docker Sbx

github-actions · 2026-09-07T14:42:03Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-09-07T14:42:04Z

❌ Smoke Claude failed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8226

github-actions · 2026-09-07T14:42:06Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-09-07T14:42:10Z

✅ Contribution Check completed successfully!

PR #8226 follows the applicable contribution guidelines in CONTRIBUTING.md. The change adds focused tests for the new helper, keeps files in the correct directories, and the PR description clearly explains the extraction and links the related issue.

Generated by Contribution Check for #8226

github-actions · 2026-09-07T14:42:11Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-09-07T14:42:12Z

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-09-07T14:42:13Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-09-07T14:42:14Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #8226

github-actions · 2026-09-07T14:42:15Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-09-07T14:42:16Z

🌑 The shadows whisper... Smoke Codex failed. The oracle requires further meditation...

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-09-07T14:42:17Z

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-09-07T14:42:30Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-09-07T14:42:32Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-09-07T14:42:54Z

✅ Security Guard completed successfully!

Security review of PR #8226 complete: Extract shared auth-header builder for OpenAI and Copilot provider adapters. Changes are refactoring-only (consolidating duplicated auth header logic into buildAuthHeaderFn). No security-weakening changes detected: no expanded ACLs, no weakened validation, no secrets exposure, no capability additions, no firewall chain changes. Passes security review.

Generated by Security Guard for #8226

github-actions · 2026-09-07T14:46:31Z

Smoke Test: Services Connectivity

Redis PING: ❌ (Temporary failure in name resolution)
pg_isready: ❌ (no response)
PostgreSQL SELECT 1: ❌ (could not translate host name)

Overall: FAIL — host.docker.internal did not resolve; AWF sandbox cannot reach host service containers.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-09-07T14:46:39Z

Smoke Test: API Proxy OTEL Tracing — Results

Scenario 1 (Module loading): ✅ otel.js loads cleanly, exports startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, plus exporter/serialization internals.
Scenario 2 (Test suite): ✅ 3 suites / 68 tests passed (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js).
Scenario 3 (Env var forwarding): ✅ env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID/GITHUB_AW_OTEL_PARENT_SPAN_ID (+ COPILOT_OTEL_FILE_EXPORTER_PATH) into the agent; api-proxy-env-config.ts buildOtelEnv() forwards OTLP endpoint/headers, service name, and parent trace context into api-proxy.
Scenario 4 (Token tracker integration): ✅ onUsage callback present in token-tracker-http.js (invoked after normalized usage extraction) as the OTEL hook point.
Scenario 5 (OTEL diagnostics): ✅ /tmp/gh-aw/otel.jsonl contains 1 exported span with service.name=gh-aw.smoke-otel-tracing, workflow/run resource attributes — confirms OTLP export path is functioning for this run.

Overall: All 5 scenarios pass. No unexpected failures detected.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-09-07T14:46:41Z

EGRESS_RESULT allow=pass deny=pass

✅ allowed domain (api.github.com) reachable — HTTP 200
✅ non-allowed domain (example.com) blocked — CONNECT tunnel failed 403

Overall status: PASS

@lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-09-07T14:46:42Z

Smoke Test: Copilot BYOK (Direct) Mode

✅ GitHub MCP Testing — Verified connectivity to github/gh-aw-firewall (2 merged PRs listed)
✅ GitHub.com Connectivity — HTTP 200
✅ File Write/Read Test — File exists and readable
✅ BYOK Inference Test — Running in direct BYOK mode via api-proxy → api.githubcopilot.com

Status: PASS

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) with inference routed through api-proxy sidecar to api.githubcopilot.com.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-09-07T14:46:46Z

Smoke Test: Copilot Engine — @lpcox

MCP connectivity: ✅ (PR docs: add B31 runner-doctor guidance for sudo secure_path PATH shadowing #8218 confirmed)
GitHub.com connectivity: ✅ (HTTP 200)
File write/read: ✅

Recent PRs:

docs: add B31 runner-doctor guidance for sudo secure_path PATH shadowing #8218: docs: add B31 runner-doctor guidance for sudo secure_path PATH shadowing
feat: add dynamic GitHub-MCP-backed enclave repository admission #8217: feat: add dynamic GitHub-MCP-backed enclave repository admission

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-07T14:48:01Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A (ran ok)	✅ PASS
.NET	json-parse	✅	N/A (ran ok)	✅ PASS
Go	color	✅	pass	✅ PASS
Go	env	✅	pass	✅ PASS
Go	uuid	✅	pass	✅ PASS
Java	gson	✅	pass (quiet)	✅ PASS
Java	caffeine	✅	pass (quiet)	✅ PASS
Node.js	clsx	✅	pass	✅ PASS
Node.js	execa	✅	pass	✅ PASS
Node.js	p-limit	✅	pass	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

Java required setting -Dmaven.repo.local to a writable directory (~/.m2/repository was root-owned/non-writable in this environment); once redirected, mvn compile/mvn test ran cleanly through the Squid proxy (JAVA_TOOL_OPTIONS proxy settings applied correctly).
All other ecosystems built/installed and ran their test suites successfully on the first attempt.

Generated by Build Test Suite for #8226 · copilot · auto · 37.9 AIC · ⊞ 12K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-07T14:48:21Z

MCP tool connectivity: ❌
GitHub.com connectivity: ✅
File read/write test: ✅
Direct BYOK inference: ✅
Running in direct BYOK mode via api-proxy -> Azure OpenAI (Foundry, o4-mini-aw), authenticated via Microsoft Entra
Overall status: FAIL
@Copilot @lpcox

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

github-actions · 2026-09-07T14:48:56Z

@Copilot @lpcox

GitHub MCP PRs (docs: add B31 runner-doctor guidance for sudo secure_path PATH shadowing; feat: add dynamic GitHub-MCP-backed enclave repository admission): ❌
GitHub.com connectivity: ✅
File I/O test: ✅
BYOK inference: ✅

Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: FAIL

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

github-actions · 2026-09-07T15:16:40Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.20.0	v2.98.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

⚠️ Not all versions matched — Node.js reported v2.98.0 in the chroot environment vs v24.20.0 on the host. smoke-chroot label not applied since ALL_TESTS_PASSED=false.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

Initial plan

cfbc258

Copilot AI assigned Copilot and lpcox Sep 6, 2026

Copilot AI linked an issue Sep 6, 2026 that may be closed by this pull request

[Duplicate Code] Copilot and OpenAI provider auth setup repeats branching logic #8225

Closed

Copilot started work on behalf of lpcox September 6, 2026 22:11 View session

refactor: share auth-header builder between OpenAI and Copilot adapters

3f32e33

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Refactor provider auth setup to eliminate duplicate code~~ Extract shared auth-header builder for OpenAI and Copilot provider adapters Sep 6, 2026

Copilot AI requested a review from lpcox September 6, 2026 22:17

Copilot finished work on behalf of lpcox September 6, 2026 22:17

lpcox marked this pull request as ready for review September 6, 2026 22:17

Copilot AI balanced review requested due to automatic review settings September 6, 2026 22:17

Copilot AI reviewed Sep 6, 2026

lpcox requested a balanced review from Copilot September 6, 2026 23:16

Copilot AI reviewed Sep 6, 2026

lpcox requested a balanced review from Copilot September 7, 2026 03:33

Copilot started reviewing on behalf of lpcox September 7, 2026 03:34 View session

Copilot AI reviewed Sep 7, 2026

View reviewed changes

Comment thread containers/api-proxy/providers/auth-headers.js Outdated

Clarify header handling in auth-headers.js

7065263

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

lpcox added the ready-for-aw label Sep 7, 2026

lpcox deployed to aoai-model September 7, 2026 14:42 — with GitHub Actions Active

github-actions Bot mentioned this pull request Sep 7, 2026

[aw] Smoke Gemini failed #8255

Closed

github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Sep 7, 2026

github-actions Bot added the smoke-copilot-byok label Sep 7, 2026

github-actions Bot added the smoke-copilot label Sep 7, 2026

github-actions Bot mentioned this pull request Sep 7, 2026

[aw] Smoke Docker Sbx failed #8256

Closed

lpcox deployed to aoai-model September 7, 2026 14:47 — with GitHub Actions Active

github-actions Bot added the build-test label Sep 7, 2026

github-actions Bot added the smoke-copilot-byok-aoai-entra label Sep 7, 2026

lpcox deployed to aoai-model September 7, 2026 14:48 — with GitHub Actions Active

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Sep 7, 2026

github-actions Bot mentioned this pull request Sep 7, 2026

[aw] Smoke Claude failed #8258

Closed

lpcox merged commit 12450b5 into main Sep 7, 2026
168 of 175 checks passed

lpcox deleted the copilot/duplicate-code-provider-auth-setup branch September 7, 2026 14:57

github-actions Bot mentioned this pull request Sep 11, 2026

[docs] auth: docs: correct /models GET auto API-version claim in auth-matrix #8442

Merged

Uh oh!

Conversation

Copilot AI commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Shared helper

Adapter updates

Tests

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

github-actions Bot commented Sep 7, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 7, 2026

Smoke Test: Services Connectivity

Uh oh!

github-actions Bot commented Sep 7, 2026

Smoke Test: API Proxy OTEL Tracing — Results

Uh oh!

github-actions Bot commented Sep 7, 2026

Uh oh!

github-actions Bot commented Sep 7, 2026

Smoke Test: Copilot BYOK (Direct) Mode

Copilot AI commented Sep 6, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading

github-actions Bot commented Sep 7, 2026 •

edited

Loading