Fix DIFC proxy GHEC data-residency REST API host derivation#8203
Merged
Conversation
The DIFC proxy forwards `gh api` (REST/GraphQL) calls, but on GHEC data-residency tenants (*.ghe.com) it derived the upstream host as `copilot-api.<tenant>.ghe.com` — the Copilot inference endpoint, which does not serve the REST API. As a result `gh api rate_limit` forwarded through the proxy failed, breaking the AWF awf-cli-proxy liveness probe. Derive the correct REST API host `api.<tenant>.ghe.com` from GITHUB_SERVER_URL instead. This also makes GHEC GraphQL routing identical to github.com (`/graphql`), so the incorrect `copilot-api` GraphQL special case is removed. Fixes #8202 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes the DIFC proxy’s upstream GitHub API host derivation for GHEC data-residency tenants (*.ghe.com) so REST/GraphQL forwarding targets the correct REST API host (api.<tenant>.ghe.com) instead of the Copilot inference host (copilot-api.<tenant>.ghe.com).
Changes:
- Update
GITHUB_SERVER_URL→ API base derivation for*.ghe.comto useapi.<tenant>.ghe.com(preserving port). - Simplify GraphQL URL rewriting in the proxy by removing the
copilot-api.*.ghe.comspecial case and treating GHEC data residency like dotcom (/graphql). - Update unit tests and documentation to match the corrected behavior and clarify the REST-vs-Copilot-host distinction.
Show a summary per file
| File | Description |
|---|---|
| internal/envutil/github.go | Fix .ghe.com API base derivation to api.<tenant>.ghe.com and update related logging/comments. |
| internal/envutil/github_test.go | Update derivation expectations for GHEC data-residency mappings. |
| internal/envutil/github_coverage_test.go | Update edge-case coverage expectations for .ghe.com host derivation. |
| internal/proxy/proxy.go | Remove copilot-api GraphQL routing special-case; route GHEC data residency GraphQL to /graphql. |
| internal/proxy/forward_to_github_test.go | Update GraphQL path routing expectations for GHEC data residency (/api/graphql → /graphql). |
| docs/ENVIRONMENT_VARIABLES.md | Update documented derivation rules and examples to use api.*.ghe.com. |
| docs/AWF_PIPELINE_ENVIRONMENT_VARIABLES.md | Clarify distinction between Copilot inference (copilot-api.*) and DIFC REST/GraphQL proxy (api.*). |
| AGENTS.md | Update environment variable documentation to reflect api.*.ghe.com derivation. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 8/8 changed files
- Comments generated: 1
- Review effort level: Low
Comment on lines
106
to
+111
| case strings.HasSuffix(hostname, ".ghe.com"): | ||
| var apiURL string | ||
| if port := parsed.Port(); port != "" { | ||
| apiURL = fmt.Sprintf("%s://copilot-api.%s:%s", parsed.Scheme, hostname, port) | ||
| apiURL = fmt.Sprintf("%s://api.%s:%s", parsed.Scheme, hostname, port) | ||
| } else { | ||
| apiURL = fmt.Sprintf("%s://copilot-api.%s", parsed.Scheme, hostname) | ||
| apiURL = fmt.Sprintf("%s://api.%s", parsed.Scheme, hostname) |
Collaborator
Author
|
@copilot address review feedback |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #8202 — the mcpg DIFC proxy was not GHEC data-residency (
*.ghe.com) aware in the right way.The DIFC proxy forwards
gh api(REST/GraphQL) calls, but on GHEC data-residency tenants it derived the upstream API host ascopilot-api.<tenant>.ghe.com— the Copilot inference endpoint, which does not serve the REST API. As a resultgh api rate_limitforwarded through the proxy failed (root cause of github/gh-aw#41225, where the AWFawf-cli-proxyliveness probe failed withdiagnosis=unknown).Root cause
deriveAPIFromServerURLininternal/envutil/github.gomappedhttps://tenant.ghe.com→https://copilot-api.tenant.ghe.com. That subdomain is the Copilot endpoint, not the REST API. The correct GHEC data-residency REST API base ishttps://api.<tenant>.ghe.com(confirmed by GitHub docs and this repo's owndocs/AWF_PIPELINE_ENVIRONMENT_VARIABLES.md§1).Changes
internal/envutil/github.go: GHEC derivation now produceshttps://api.<tenant>.ghe.com(REST API host), preserving any port.internal/proxy/proxy.go: Removed thecopilot-api-basedisGHECDataResidencyHostGraphQL special case. With the corrected host, GHEC GraphQL lives at/graphql(same as github.com), matchingGITHUB_GRAPHQL_URL=https://api.<tenant>.ghe.com/graphql.envutil,proxy) to the corrected expectations.ENVIRONMENT_VARIABLES.md,AGENTS.md) and clarified inAWF_PIPELINE_ENVIRONMENT_VARIABLES.mdthat the DIFC/REST proxy targetsapi.<slug>.ghe.com, distinct from the Copilot inference sidecar which usescopilot-api.<slug>.ghe.com.Verification
make agent-finishedpasses (format, build, lint, Go tests, Rust guard tests).Note on companion issues
This addresses the root cause in
github/gh-aw-mcpg. The companion issues remain:GITHUB_SERVER_URLreaches the proxy.diagnosis=unknownprobe message with the actual HTTP status/body.