Conversation
…revent GHES host leakage Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR aims to prevent a workflow-level GH_HOST (e.g., a GHES hostname) from leaking into the “Install GitHub Copilot CLI” step by explicitly setting GH_HOST: github.com at the step level.
Changes:
- Add a step-level
env: GH_HOST: github.comoverride to the Copilot CLI install step generation. - Update unit tests to assert the presence of
GH_HOST: github.com. - Regenerate wasm golden outputs to include the new
env:block.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/copilot_installer.go | Adds step-level GH_HOST override and documents the rationale. |
| pkg/workflow/copilot_installer_test.go | Asserts GH_HOST: github.com is present in generated install steps. |
| pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden | Updates expected YAML output with the new env: block. |
| pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden | Updates expected YAML output with the new env: block. |
| pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden | Updates expected YAML output with the new env: block. |
Comments suppressed due to low confidence (1)
pkg/workflow/copilot_installer.go:26
- The new comment says the Copilot CLI download "requires github.com authentication", but the current installer script downloads release artifacts via unauthenticated
curlfrom github.com (actions/setup/sh/install_copilot_cli.sh). Consider rewording this comment to avoid implying authentication is required for the download step, or explicitly note what operation actually requires auth.
// (e.g. a GHES hostname) does not leak into this step. The Copilot CLI binary is always
// downloaded from github.com and requires github.com authentication. This step-level
// env override only affects the install_copilot_cli.sh execution and has no impact on
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
| " - name: " + stepName, | ||
| " run: /opt/gh-aw/actions/install_copilot_cli.sh " + version, | ||
| " env:", | ||
| " GH_HOST: github.com", | ||
| } |
|
@copilot recompile |
… install step Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Done — all 173 lock files recompiled in 950edff. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
Smoke test (Codex) complete.
Warning
|
Smoke Test Results — Run §23098313105
Overall: PARTIAL (2 skipped, 0 failed)
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
💥 [THE END] — Illustrated by Smoke Claude
| - name: Install GitHub Copilot CLI | ||
| run: /opt/gh-aw/actions/install_copilot_cli.sh latest | ||
| env: | ||
| GH_HOST: github.com |
There was a problem hiding this comment.
Good fix — setting GH_HOST: github.com explicitly prevents GHES host leakage when the CLI install runs in enterprise environments.
| - name: Install GitHub Copilot CLI | ||
| run: /opt/gh-aw/actions/install_copilot_cli.sh latest | ||
| env: | ||
| GH_HOST: github.com |
There was a problem hiding this comment.
Consistent env override applied across all workflow lock files — this pattern ensures the Copilot CLI always authenticates against github.com regardless of the runner's GH_HOST context.
|
Commit pushed:
|
…ses to fix TypeScript error Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Fixed in 1918606. The CI Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Summary
When a workflow sets
env: GH_HOST: <ghes-host>(required for GHES), that value leaked into theInstall GitHub Copilot CLIstep. Because the Copilot CLI binary is always downloaded fromgithub.com, explicitly pinningGH_HOST: github.comat the step level ensures the step is isolated from any workflow-level override, providing a defensive guard regardless of how the install script evolves.Changes
pkg/workflow/copilot_installer.go: Explicitly emitenv: GH_HOST: github.comon theInstall GitHub Copilot CLIstep. This step-level override isolates the install from any workflow-levelGH_HOSTvalue and only affectsinstall_copilot_cli.sh; it has no impact on other workflow steps.pkg/workflow/copilot_installer_test.go: AddedGH_HOST: github.comassertions to all existing test cases plusTestCopilotInstallerCustomVersion.pkg/workflow/testdata/wasm_golden/**: Regenerated golden files to reflect the newenv:block..github/workflows/*.lock.yml: Recompiled all 173 workflow lock files to include the newenv:block on the install step.Testing
All existing unit tests pass. Golden files updated via
go test -update. All 173 lock files recompiled viamake recompile.📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.
✨ PR Review Safe Output Test - Run 23098313105