From 2a77c292455498e3f5617bc972b06c8204d12dcc Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 1 Aug 2026 11:08:31 +0000 Subject: [PATCH] [docs] clarify BYOK threat detection target and go network group --- docs/src/content/docs/reference/engines.md | 2 +- docs/src/content/docs/reference/network.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/src/content/docs/reference/engines.md b/docs/src/content/docs/reference/engines.md index 09fbfa7652a..1e787109695 100644 --- a/docs/src/content/docs/reference/engines.md +++ b/docs/src/content/docs/reference/engines.md @@ -180,7 +180,7 @@ network: The Copilot engine supports routing requests to an external LLM provider instead of GitHub's default routing. This is useful when you want to use a different model or provider (e.g., OpenAI, Anthropic, Azure OpenAI, or a local Ollama/vLLM instance) while still using the Copilot CLI tooling. -Set `COPILOT_PROVIDER_BASE_URL` in `engine.env` to activate BYOK mode. The credential variables `COPILOT_PROVIDER_BASE_URL`, `COPILOT_PROVIDER_API_KEY`, and `COPILOT_PROVIDER_BEARER_TOKEN` are explicitly allowed to carry `${{ secrets.* }}` references in `engine.env` under strict mode — they are not leaked to the agent container. Other `COPILOT_PROVIDER_*` variables hold non-sensitive configuration and can be set as plain strings. When `COPILOT_PROVIDER_BASE_URL` is a literal URL, gh-aw automatically adds its provider hostname to the AWF allow-list for both the main agent run and the threat-detection Copilot step. When it is supplied via a secret or variable expression, add the provider hostname explicitly to `network.allowed` so the threat-detection step can reuse that concrete host safely. +Set `COPILOT_PROVIDER_BASE_URL` in `engine.env` to activate BYOK mode. The credential variables `COPILOT_PROVIDER_BASE_URL`, `COPILOT_PROVIDER_API_KEY`, and `COPILOT_PROVIDER_BEARER_TOKEN` are explicitly allowed to carry `${{ secrets.* }}` references in `engine.env` under strict mode — they are not leaked to the agent container. Other `COPILOT_PROVIDER_*` variables hold non-sensitive configuration and can be set as plain strings. When `COPILOT_PROVIDER_BASE_URL` is a literal URL, gh-aw automatically adds its provider hostname to the AWF allow-list for both the main agent run and the threat-detection Copilot step, and the threat-detection step now derives its Copilot API target from that literal BYOK URL even when `engine.api-target` and `GITHUB_COPILOT_BASE_URL` are unset. When it is supplied via a secret or variable expression, add the provider hostname explicitly to `network.allowed` so the threat-detection step can reuse that concrete host safely. | Variable | Required | Description | |---|---|---| diff --git a/docs/src/content/docs/reference/network.md b/docs/src/content/docs/reference/network.md index 935f20c7ae2..f9fe6651a42 100644 --- a/docs/src/content/docs/reference/network.md +++ b/docs/src/content/docs/reference/network.md @@ -92,7 +92,7 @@ Mix ecosystem identifiers with specific domains for fine-grained control: | `deno` | Deno runtime (`deno.land`, `jsr.io`, `googleapis.deno.dev`) | | `dotnet` | NuGet packages and .NET SDK | | `elixir` | Elixir packages (`hex.pm`) | -| `go` | Go modules (`proxy.golang.org`, `sum.golang.org`) | +| `go` | Go modules and toolchain downloads (`proxy.golang.org`, `sum.golang.org`, `go.dev`) | | `haskell` | Haskell packages (`hackage.haskell.org`, GHCup) | | `java` | Maven Central, Gradle, Adoptium | | `julia` | Julia packages (`pkg.julialang.org`, `storage.julialang.net`) |