DIFC proxy is not enterprise-host-aware on GHEC data-residency (*.ghe.com)

[lpcox]

Summary

The mcpg DIFC proxy is not GitHub Enterprise Cloud data-residency (*.ghe.com) aware. On a *.ghe.com tenant, the proxy forwards gh api calls to the wrong GitHub API host, so requests routed through it fail even though the proxy itself comes up healthy and reports CLI proxy ready on port 18443.

This is the root cause of github/gh-aw#41225, where the AWF firewall's awf-cli-proxy sidecar liveness probe (gh api rate_limit through the DIFC proxy) fails with diagnosis=unknown — meaning the proxy is reachable but the forwarded API call returns an unexpected (HTTP error) result.

Environment

• gh-aw v0.80.9/v0.81.2; firewall v0.27.7/0.27.9; mcpg v0.3.27/v0.3.29
• Standard GitHub-hosted ubuntu-24 runner
• GitHub Enterprise Cloud, data residency (*.ghe.com)
• engine: copilot (org-billed inference)

Root cause (suspected)

The DIFC proxy is launched by actions/setup/sh/start_difc_proxy.sh with a curated environment. Workflow-level GH_HOST / GITHUB_HOST / GITHUB_ENTERPRISE_HOST never reach it (confirmed by the reporter), and the proxy does not appear to derive the enterprise API host from GITHUB_SERVER_URL. As a result the forwarded gh api rate_limit resolves/targets api.github.com instead of the tenant's *.ghe.com API host and fails.

Proposed fix

Make the DIFC proxy enterprise-host-aware:

1. Derive the target GitHub API host from GITHUB_SERVER_URL (e.g. https://<tenant>.ghe.com → API base https://<tenant>.ghe.com/api/v3 and the tenant Copilot endpoint), rather than assuming github.com.
2. Ensure start_difc_proxy.sh propagates the enterprise host into the curated env it builds for the proxy.
3. Verify token steering targets the tenant-specific Copilot endpoint on data-residency tenants.

Acceptance

• On a *.ghe.com tenant, gh api rate_limit forwarded through the DIFC proxy returns 2xx.
• The AWF awf-cli-proxy liveness probe succeeds and the agent is invoked.

Companion issues

This is tracked across three repositories:

• DIFC proxy is not enterprise-host-aware on GHEC data-residency (*.ghe.com) #8202 — (this issue) DIFC proxy enterprise-host awareness — root cause
• Compiler does not propagate enterprise host into curated DIFC-proxy env on *.ghe.com gh-aw#41911 — compiler/env propagation: inject enterprise host into the curated DIFC-proxy env
• Improve awf-cli-proxy DIFC probe diagnostics (replace opaque diagnosis=unknown) gh-aw-firewall#5615 — awf-cli-proxy probe diagnostics: replace opaque diagnosis=unknown with the actual HTTP status/body

Original report: github/gh-aw#41225
Related: github/gh-aw#21407, github/gh-aw-firewall#1300