fix: isolate Actions OIDC from agent container - #6894
Merged
Conversation
Keep GitHub Actions OIDC request credentials in the API proxy sidecar. Prevent default, env-all, env-file, and explicit environment paths from exposing them to untrusted agent code. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557
Contributor
Contributor
There was a problem hiding this comment.
Pull request overview
Isolates GitHub Actions OIDC minting credentials from the untrusted agent while preserving conditional API-proxy forwarding.
Changes:
- Excludes OIDC variables from every agent environment path.
- Adds tests for isolation and sidecar forwarding.
- Updates authentication and sandbox documentation.
Show a summary per file
| File | Description |
|---|---|
src/services/api-proxy-service-oidc.test.ts |
Verifies sidecar-only OIDC forwarding. |
src/services/agent-environment/excluded-vars.ts |
Adds OIDC variables to exclusions. |
src/services/agent-environment/env-passthrough.ts |
Removes default OIDC passthrough. |
src/services/agent-environment-credentials.test.ts |
Tests environment isolation paths. |
src/config/sandbox-mount-policy.json |
Updates Azure authentication guidance. |
docs/sbx-integration.md |
Documents sbx credential isolation. |
docs/environment.md |
Documents environment exclusions. |
docs/awf-config-spec.md |
Defines normative OIDC isolation behavior. |
docs/authentication-architecture.md |
Updates OIDC architecture and MCP guidance. |
docs/auth-matrix.md |
Notes sidecar-only OIDC handling. |
docs/api-proxy-sidecar.md |
Documents sidecar isolation and deployment guidance. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 11/11 changed files
- Comments generated: 1
- Review effort level: Balanced
Collaborator
Author
|
@copilot address review feedback |
10 tasks
Contributor
Contributor
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
Describe the runner-owned gateway flow generated by gh-aw and add direct regression coverage for env-file credential exclusion. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557
lpcox
added a commit
that referenced
this pull request
Aug 3, 2026
* docs: update authentication and API proxy guidance Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 * fix: add Anthropic WIF beta headers (#6890) * fix: add Anthropic WIF beta headers Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1bc91d4c-0fdf-40ff-94e6-250d18f08563 * fix: apply WIF beta headers unconditionally in _exchangeForAnthropicToken --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Copilot-Session: 1bc91d4c-0fdf-40ff-94e6-250d18f08563 * feat: sign AWS Bedrock requests with SigV4 (#6891) * feat: sign AWS Bedrock requests with SigV4 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 60f8a12a-5b5b-41d6-8cce-35c71f8c2ac5 * fix: reframe rewritten fallback requests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 60f8a12a-5b5b-41d6-8cce-35c71f8c2ac5 --------- Copilot-Session: 60f8a12a-5b5b-41d6-8cce-35c71f8c2ac5 * docs: correct authentication trust boundaries Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 * fix: isolate Actions OIDC from agent container (#6894) * fix: isolate Actions OIDC from agent Keep GitHub Actions OIDC request credentials in the API proxy sidecar. Prevent default, env-all, env-file, and explicit environment paths from exposing them to untrusted agent code. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 * docs: clarify OIDC agent credential boundary * docs: align OIDC isolation with MCP gateway Describe the runner-owned gateway flow generated by gh-aw and add direct regression coverage for env-file credential exclusion. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 * fix: update brace-expansion to 5.0.9 Resolve GHSA-rgw5-rvv9-x895 in the main package dependency tree. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Copilot-Session: 01b67b6c-fcd9-4c60-8409-827495c49557 Copilot-Session: 1bc91d4c-0fdf-40ff-94e6-250d18f08563 Copilot-Session: 60f8a12a-5b5b-41d6-8cce-35c71f8c2ac5
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ACTIONS_ID_TOKEN_REQUEST_URLandACTIONS_ID_TOKEN_REQUEST_TOKENout of the agent environment across default passthrough,--env-all,--env-file, and explicit--envgithub-oidcauthenticationgh-awfor remote HTTP MCPauth.type: github-oidcValidation
npm run buildnpm run lintnpm test -- --runInBandnpm run docs:buildStacked on #6889.