[docs] auth: Cross-reference Copilot auto model prefix-stripping in authentication-architecture by github-actions[bot] · Pull Request #8505 · github/gh-aw-firewall

github-actions · 2026-09-13T03:32:57Z

Summary

Scan window: 2026-09-11 → present (UTC)
Sources reviewed: README.md, docs/auth-matrix.md, docs/authentication-architecture.md, docs/api-proxy-sidecar.md, docs/environment.md, docs/awf-config-spec.md, docs/github_actions.md; containers/api-proxy/model-utils.js, model-resolver.js, model-body-rewriter.js, body-handler.js; recent PRs Support "auto" model for Pi and Codex via provider-prefix stripping #8500, fix: isolate Actions OIDC from agent container #6894, docs: update authentication and API proxy guidance #6889, feat: add Auth Doctor Updater workflow #6898; gh-aw issue #50053 (resolved by gh-aw#50054).
Corrected path: Cross-document inconsistency — docs/api-proxy-sidecar.md already documented that Copilot's own auto model selector (including the LiteLLM-style copilot/auto alias used by Codex and Pi) is supported via provider-prefix stripping (shipped in merged PR Support "auto" model for Pi and Codex via provider-prefix stripping #8500, stripRedundantProviderPrefix() in containers/api-proxy/model-utils.js), but docs/authentication-architecture.md only carried the older OpenAI-native auto limitation caveat without this clarification.
Current-main vs. pending: No pending work involved. github/gh-aw-firewall#6894 (Actions OIDC agent isolation) and github/gh-aw#50053 (runner→gateway OIDC boundary) are both merged/closed as completed; existing docs already describe them correctly as shipped, so no changes were needed there.

Documentation Changes

docs/authentication-architecture.md — Added a paragraph after the existing Codex auto OpenAI-native-limitation caveat (Example 2) clarifying that this limitation does not apply to Copilot's own auto selector: harnesses routed through the Copilot provider (port 10002), including Codex and Pi, can request auto or copilot/auto, and the api-proxy sidecar strips the redundant copilot/ prefix before forwarding so Copilot resolves it dynamically. This matches the existing, more complete explanation already present in docs/api-proxy-sidecar.md (Codex example section) and closes the gap between the two documents.

Validation

Implementation checked: containers/api-proxy/model-utils.js (stripRedundantProviderPrefix), model-resolver.js, model-body-rewriter.js, body-handler.js — confirmed the always-on prefix-stripping pipeline shipped in merged PR Support "auto" model for Pi and Codex via provider-prefix stripping #8500 on main (commit 0603bd1).
Repository history checked: merged PR Support "auto" model for Pi and Codex via provider-prefix stripping #8500 (provider-prefix stripping), PR fix: isolate Actions OIDC from agent container #6894 / gh-aw#50053+gh-aw#50054 (Actions OIDC agent isolation, confirmed merged/closed) — no other open or unmerged auth-related work found affecting these docs since the 2026-09-11 scan window.
Cross-document consistency: compared the Codex/Copilot auto guidance in docs/api-proxy-sidecar.md and docs/authentication-architecture.md; wording and cross-reference link now aligned.
Markdown/link review: verified the added paragraph's relative link (api-proxy-sidecar.md#codex-openai-example) matches the existing anchor already used earlier in the same file.
Credential-leakage review: diffed the change — no tokens, keys, JWTs, or credential-bearing values present; only model-name/routing documentation.
Duplicate PR check: searched open PRs titled [docs] auth: — none found covering this specific cross-reference gap.

Sources

Support "auto" model for Pi and Codex via provider-prefix stripping #8500 (Support "auto" model for Pi and Codex via provider-prefix stripping — merged)
fix: isolate Actions OIDC from agent container #6894 (fix: isolate Actions OIDC from agent container — merged)
Ensure HTTP MCP GitHub OIDC bypasses the AWF agent credential boundary gh-aw#50053 (Ensure HTTP MCP GitHub OIDC bypasses the AWF agent credential boundary — closed, completed)
Enforce runner→gateway OIDC path and prevent AWF agent exposure for HTTP MCP auth gh-aw#50054 (Enforce runner→gateway OIDC path and prevent AWF agent exposure for HTTP MCP auth — merged)

Generated by Auth Doctor Updater · copilot · auto · 96.3 AIC · ⊞ 10.7K · ◷

…cation-architecture Codex's OpenAI-native auto limitation was documented, but the authentication-architecture guide did not note that Copilot's own auto selector (including the copilot/auto LiteLLM-style alias used by Codex and Pi) is unaffected and supported via api-proxy prefix stripping (stripRedundantProviderPrefix, shipped in #8500). This was already documented in docs/api-proxy-sidecar.md but missing here, causing a cross-document inconsistency. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🟢 Approval recommended

The documentation accurately matches the implemented and tested prefix-stripping behavior.

Pull request overview

Clarifies that Copilot’s auto model supports copilot/auto through provider-prefix normalization.

Changes:

Distinguishes Copilot auto from OpenAI-native auto.
Documents automatic removal of the redundant copilot/ prefix.

File summaries

File	Description
`docs/authentication-architecture.md`	Adds Copilot model-routing clarification and cross-reference.

Review details

Files reviewed: 1/1 changed files
Comments generated: 0
Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-09-14T02:21:05Z

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

Download the docs-preview-pr-8505 artifact from the workflow run
Unzip and open index.html in your browser

Built from commit 88dede6

github-actions · 2026-09-14T02:22:53Z

✅ Copilot review passed with no inline comments.

@github-actions[bot] Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

github-actions · 2026-09-14T02:29:46Z

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-09-14T02:29:47Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 7 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
msfeed25.pkgs.visualstudio.com
www.google.com
www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-09-14T02:29:48Z

✅ Build Test Suite completed successfully!

Generated by Build Test Suite for #8505

github-actions · 2026-09-14T02:29:49Z

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

github-actions · 2026-09-14T02:29:51Z

❌ Smoke Gemini reports failed. Facets need polishing...

💎 Faceted by Smoke Gemini

github-actions · 2026-09-14T02:29:51Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-09-14T02:29:52Z

📰 DEVELOPING STORY: Smoke Docker Sbx reports failed. Our correspondents are investigating the incident...

📰 BREAKING: Report filed by Smoke Docker Sbx

github-actions · 2026-09-14T02:29:53Z

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-09-14T02:29:55Z

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-09-14T02:29:59Z

🚀 Security Guard has started processing this pull request

github-actions · 2026-09-14T02:29:59Z

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-09-14T02:30:01Z

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

github-actions · 2026-09-14T02:30:07Z

✅ Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8505

github-actions · 2026-09-14T02:30:20Z

🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation

github-actions · 2026-09-14T02:33:16Z

Smoke Test: Copilot Engine — @lpcox

✅ GitHub MCP: PR Support "auto" model for Pi and Codex via provider-prefix stripping #8500 "Support "auto" model for Pi and Codex via provider-prefix stripping"
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read test

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

github-actions · 2026-09-14T02:33:36Z

✅ Copilot BYOK (Direct) Mode Smoke Test PASSED

✅ GitHub MCP connectivity (list_pull_requests verified)
✅ GitHub.com connectivity (HTTP 200)
✅ File write/read (smoke-test-copilot-byok.txt accessible)
✅ BYOK inference (direct → api-proxy → api.githubcopilot.com)

Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY) via api-proxy sidecar
Status: PASS

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

github-actions · 2026-09-14T02:33:41Z

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com) reachable: allowed=200
✅ Blocked domain (example.com) denied: 403 CONNECT tunnel failure

Overall: PASS

cc @lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

github-actions · 2026-09-14T02:33:59Z

Smoke Test: Claude Engine Validation

Check	Result
API status	✅ PASS
`gh` check	✅ PASS
File status	✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8505 · claude · haiku45 · 55.2 AIC · ⊞ 4.5K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-14T02:34:16Z

📡 OTel Tracing Smoke Test Results

#	Scenario	Result
1	OTEL module initialization (`otel.js` loads, `isEnabled()`)	✅ Loaded; `isEnabled: true`; exports include `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`
2	Test suite (`npx jest --testPathPatterns='otel'`)	✅ 3 suites, 68/68 tests passed (`otel.test.js`, `otel-fanout.test.js`, `otel-workload-identity.test.js`)
3	Env var forwarding	✅ `env-passthrough.ts` forwards `GITHUB_AW_OTEL_TRACE_ID`/`GITHUB_AW_OTEL_PARENT_SPAN_ID`; `api-proxy-env-config.ts` forwards `GH_AW_OTLP_ENDPOINTS`, `OTEL_EXPORTER_OTLP_ENDPOINT`, and trace context
4	Token tracker OTEL hook	✅ `token-tracker-http.js` contains the `onUsage` callback used as the OTEL integration point
5	OTLP export via Squid	✅ `otel.jsonl` contains an exported span (`gh-aw.agent.setup`, correct traceId/parentSpanId, `gen_ai.system` attribute); Squid access log shows successful `CONNECT 200 TCP_TUNNEL` requests from the api-proxy container (172.30.0.30) to `o205451.ingest.us.sentry.io:443`

Summary: All 5 scenarios passed — OTEL module loading, span creation, GenAI usage attributes, env var/context propagation, and OTLP export through Squid are all working as expected. No regressions detected.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

github-actions · 2026-09-14T02:34:51Z

Smoke Test: Services Connectivity — PASS ✅

Redis PING: ✅ PONG
PostgreSQL pg_isready: ✅ accepting connections
PostgreSQL SELECT 1: ✅ 1

Overall: PASS

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

github-actions · 2026-09-14T02:35:28Z

Support "auto" model for Pi and Codex via provider-prefix stripping
chore(workflows): upgrade gh-aw to v0.89.8
Merged PR review/details: ✅
Playwright title check: ✅
Temp file write/read: ✅
Discussion comment: ❌
AWF build: ✅
Overall: FAIL

Warning

Firewall blocked 7 domains

The following domains were blocked by the firewall during workflow execution:

accounts.google.com
android.clients.google.com
clients2.google.com
contentautofill.googleapis.com
msfeed25.pkgs.visualstudio.com
www.google.com
www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "msfeed25.pkgs.visualstudio.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

github-actions · 2026-09-14T02:35:30Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — PASS

Note: Java's local Maven repository (~/.m2/repository) initially failed with a permission error unrelated to the firewall (the directory was pre-created as root-owned in this runner environment). Resolved by pointing localRepository to a writable path in ~/.m2/settings.xml; the Squid proxy configuration itself worked correctly (JAVA_TOOL_OPTIONS proxy settings were honored).

Generated by Build Test Suite for #8505 · copilot · auto · 49.4 AIC · ⊞ 10.6K · ◷
_{Add label ready-for-aw to run again}

github-actions · 2026-09-14T02:35:50Z

Chroot vs Host Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.14	Python 3.12.14	✅ YES
Node.js	v24.20.0	v22.23.2	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: Not all tests passed (ALL_TESTS_PASSED=false) — Node.js version differs between host and chroot environment. smoke-chroot label was not added.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

github-actions Bot added ai-generated documentation Improvements or additions to documentation labels Sep 13, 2026

lpcox requested a balanced review from Copilot September 14, 2026 02:07

Copilot started reviewing on behalf of lpcox September 14, 2026 02:07 View session

Copilot AI reviewed Sep 14, 2026

View reviewed changes

lpcox added the ready-for-aw label Sep 14, 2026

lpcox had a problem deploying to aoai-model September 14, 2026 02:30 — with GitHub Actions Failure

github-actions Bot added the smoke-copilot label Sep 14, 2026

github-actions Bot added smoke-copilot-byok smoke-copilot-network-isolation Copilot network-isolation egress smoke test labels Sep 14, 2026

github-actions Bot added the smoke-claude label Sep 14, 2026

lpcox deployed to aoai-model September 14, 2026 02:34 — with GitHub Actions Active

github-actions Bot mentioned this pull request Sep 14, 2026

[aw] Smoke Docker Sbx failed #8520

Closed

lpcox deployed to aoai-model September 14, 2026 02:34 — with GitHub Actions Active

github-actions Bot added the smoke-services label Sep 14, 2026

github-actions Bot mentioned this pull request Sep 14, 2026

[aw] Smoke Codex is missing required tool #8522

Closed

lpcox merged commit ed0553e into main Sep 14, 2026
164 of 170 checks passed

lpcox deleted the docs-auth-copilot-auto-prefix-strip-4e9196abf4a00cd9 branch September 14, 2026 03:46

github-actions Bot mentioned this pull request Sep 14, 2026

refactor: split cloud-hypervisor cleanup registry into focused modules #8519

Merged

Conversation

github-actions Bot commented Sep 13, 2026

Summary

Documentation Changes

Validation

Sources

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

github-actions Bot commented Sep 14, 2026

Documentation Preview

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

Smoke Test: Claude Engine Validation

Uh oh!

github-actions Bot commented Sep 14, 2026

📡 OTel Tracing Smoke Test Results

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

Uh oh!

github-actions Bot commented Sep 14, 2026

🏗️ Build Test Suite Results

Uh oh!

github-actions Bot commented Sep 14, 2026

Chroot vs Host Version Comparison

Uh oh!

Uh oh!

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading

github-actions Bot commented Sep 14, 2026 •

edited

Loading