Skip to content

feat(api-proxy): forward COPILOT_INTEGRATION_ID from host env#4828

Closed
anticomputer wants to merge 2 commits into
github:mainfrom
anticomputer:anticomputer/forward-copilot-integration-id
Closed

feat(api-proxy): forward COPILOT_INTEGRATION_ID from host env#4828
anticomputer wants to merge 2 commits into
github:mainfrom
anticomputer:anticomputer/forward-copilot-integration-id

Conversation

@anticomputer

Copy link
Copy Markdown

Summary

Allow external callers using AWF as a network firewall + auth proxy to set their own Copilot-Integration-Id on outbound Copilot API requests by forwarding the COPILOT_INTEGRATION_ID env var from the host process to the api-proxy container.

Problem

The api-proxy unconditionally rewrites the Copilot-Integration-Id header from env.COPILOT_INTEGRATION_ID (defaulting to the api-proxy built-in, currently agentic-workflows). The CLI wrapper deliberately does not forward COPILOT_INTEGRATION_ID to the api-proxy container, so external callers have no way to opt out:

  • Whatever Copilot-Integration-Id the caller sends to the api-proxy is discarded.
  • All requests are attributed to AWF on the upstream provider's side, even when the underlying caller is a distinct product with its own identity.
  • Some upstream models (e.g. internal preview models) are scoped to specific integration IDs. A caller whose integration ID is not on the allowlist silently loses access when routed through AWF -- and crucially, a caller whose integration ID is on the allowlist gets that access by accident, depending on whatever value the api-proxy happens to default to in the pinned AWF version.

In our pipeline this surfaced as: every audit our taskflow agent runs is silently tagged as the api-proxy default integration ID, regardless of what our agent code requests. We discovered this while investigating dashboard attribution, and only afterwards realised the v0.25.46 -> v0.25.47 flip of the api-proxy default would have silently removed model access for any caller depending on the old default.

Change

Mirror the existing GITHUB_API_URL / GITHUB_SERVER_URL forwarding pattern in api-proxy-service-config.ts: forward COPILOT_INTEGRATION_ID from the host env to the api-proxy container when (and only when) it is explicitly set.

Default behaviour is unchanged: unset on the host -> not set on api-proxy -> falls back to whatever default the api-proxy ships with.

The gh-aw-prefixed variant (GITHUB_COPILOT_INTEGRATION_ID) is intentionally still stripped, because that one is set by gh-aw for AWF's own bookkeeping. Existing tests covering that strip-behaviour continue to pass.

Tests

Two new tests under the existing describe('COPILOT_INTEGRATION_ID forwarding') block in api-proxy-service-api-targets.test.ts:

  • forwards COPILOT_INTEGRATION_ID to api-proxy when explicitly set on the host
  • does not set it on api-proxy when the host env var is empty string
PASS src/services/api-proxy-service-api-targets.test.ts
Tests:       56 passed, 56 total

Full src/services/ suite: 392 pass, 1 pre-existing unrelated failure on main (agent-volumes-mounts.test.ts -- reproduced before applying this change).

tsc --noEmit: clean. eslint: no new warnings introduced.

External callers using AWF as a network firewall + auth proxy currently
cannot set their own Copilot-Integration-Id: the api-proxy unconditionally
rewrites the header from env.COPILOT_INTEGRATION_ID (defaulting to AWF's
own 'agentic-workflows' tag), and the CLI wrapper does not forward this
variable to the api-proxy container.

This means every request the api-proxy emits is attributed to AWF on the
upstream provider's side, even when the underlying caller is a distinct
product with its own identity (and, in some cases, its own model
allowlist). The caller has no way to opt out short of patching AWF.

Mirror the existing GITHUB_API_URL / GITHUB_SERVER_URL pattern and
forward COPILOT_INTEGRATION_ID to the api-proxy container when (and only
when) the host env explicitly sets it. Default behaviour is unchanged:
unset on the host -> not set on api-proxy -> falls back to the api-proxy
built-in default.

Tests added:
- forward COPILOT_INTEGRATION_ID when explicitly set on host env
- do NOT set on api-proxy when host env var is empty string

(The existing 'do not forward GITHUB_COPILOT_INTEGRATION_ID' tests
continue to pass -- the gh-aw-prefixed variant is intentionally still
stripped because that one is set by gh-aw for AWF's own bookkeeping.)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 12, 2026 18:03

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the api-proxy sidecar configuration so a host-provided Copilot integration identifier can be forwarded, enabling external callers to attribute requests to their own integration ID when desired.

Changes:

  • Forward COPILOT_INTEGRATION_ID into the api-proxy container environment when explicitly set on the host.
  • Add tests verifying forwarding behavior when set vs. when empty.
Show a summary per file
File Description
src/services/api-proxy-service-config.ts Adds conditional forwarding of COPILOT_INTEGRATION_ID to api-proxy env configuration.
src/services/api-proxy-service-api-targets.test.ts Adds test coverage for forwarding and non-forwarding of COPILOT_INTEGRATION_ID.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 2/2 changed files
  • Comments generated: 2

Comment thread src/services/api-proxy-service-config.ts Outdated
Comment thread src/services/api-proxy-service-api-targets.test.ts Outdated
Addresses review feedback on github#4828:

1. Whitespace-only env values (e.g. '   ') previously passed the
   truthiness check and would have been forwarded to api-proxy,
   overriding its default with a meaningless value. Trim before the
   check and trim the forwarded value so accidental whitespace is
   treated as unset.

2. The COPILOT_INTEGRATION_ID forwarding tests duplicated the manual
   process.env save/restore pattern across every it() block. Replace
   with beforeEach/afterEach scoped to the describe (snapshotting both
   GITHUB_COPILOT_INTEGRATION_ID and COPILOT_INTEGRATION_ID), and a tiny
   local proxyEnv() helper to remove the repeated generateDockerCompose
   boilerplate. Net effect: each test body is one or two lines.

Two new tests cover the trim behaviour:
- 'should not set COPILOT_INTEGRATION_ID when host env var is whitespace only'
- 'should trim surrounding whitespace before forwarding'

58 tests in this file (was 56), all passing. Full src/services/ suite
still has the single pre-existing failure in agent-volumes-mounts.test.ts
that was present on main before this PR.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@lpcox

lpcox commented Jun 12, 2026

Copy link
Copy Markdown
Collaborator

@anticomputer sorry we don't accept PRs. please file as an issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants