Fix Copilot SDK API proxy routing in docker-sbx by Copilot · Pull Request #52210 · github/gh-aw

Copilot · 2026-08-12T03:22:46Z

The daily action/setup/* security audit failed because Copilot SDK requests inside docker-sbx resolved api-proxy to localhost, but only the /reflect management bridge was listening there. Model requests to provider ports such as api-proxy:10002 therefore failed with ECONNREFUSED.

Runtime routing
- Detects sbx HOSTALIASES mode where api-proxy maps to localhost/127.0.0.1.
- Rewrites SDK-facing API proxy URLs to the host bridge (host.docker.internal) so provider traffic reaches the api-proxy sidecar.
Reflect/model helpers
- Applies the same rewrite to fallback model fetches and multi-provider base URL resolution.
- Preserves existing api-proxy URLs outside sbx host-alias mode.
Regression coverage
- Adds tests for host-alias detection, URL rewriting, override host support, and Copilot multi-provider base URL resolution.

// sbx HOSTALIASES mode
"http://api-proxy:10002/models"
// becomes
"http://host.docker.internal:10002/models"

Fixes [aw] Daily action/setup/* Security Audit failed #52205

branch refresh requested in run https://github.com/github/gh-aw/actions/runs/31644728185> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 18.5 AIC · ⌖ 5.27 AIC · ⊞ 8.5K · ◷

_{Comment /souschef to run again}

Run context: https://github.com/github/gh-aw/actions/runs/31649732812> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.78 AIC · ⌖ 5.39 AIC · ⊞ 8.5K · ◷

_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 9.56 AIC · ⌖ 5.07 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 5.89 AIC · ⌖ 5.09 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Branch update requested by pr-sous-chef for run https://github.com/github/gh-aw/actions/runs/31692375821.> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.7 AIC · ⌖ 5.21 AIC · ⊞ 8.5K · ◷

_{Comment /souschef to run again}

Run: https://github.com/github/gh-aw/actions/runs/31694426361> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.86 AIC · ⌖ 3.48 AIC · ⊞ 8.5K · ◷

_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.9 AIC · ⌖ 5.13 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.7 AIC · ⌖ 6.5 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-08-12T06:49:15Z

Triage: pr-type:bug · pr-risk:medium · Score 69/100 (impact 30, urgency 25, quality 14)

Recommended action: fast_track

Fixes a daily security-audit failure: Copilot SDK requests inside docker-sbx fail to reach api-proxy due to HOSTALIASES localhost resolution. Directly unblocks a recurring CI/security check. Draft, CI not yet run — recommend promoting from draft and expediting review given the CI-blocking impact.

Generated by 🔧 PR Triage Agent · auto · 44.6 AIC · ⌖ 2.44 AIC · ⊞ 7.8K · ◷

github-actions · 2026-08-12T12:37:01Z

Triage

Category: bug
Risk: medium
Priority score: 70/100 (impact 30, urgency 25, quality 15)
Action: fast_track

Fixes Copilot SDK API proxy routing failure surfaced by daily action/setup security audit. Small, targeted diff (98 additions / 3 deletions). CI unstable — recheck before merge.

Generated by 🔧 PR Triage Agent · auto · 41.1 AIC · ⌖ 2.53 AIC · ⊞ 7.8K · ◷

github-actions · 2026-08-12T18:36:23Z

PR Triage

Category: bug
Risk: medium
Score: 55/100 (impact 30 + urgency 15 + quality 10)
Recommended action: fast_track
Note: fixes sandbox proxy routing bug

Generated by 🔧 PR Triage Agent · auto · 39.1 AIC · ⌖ 2.59 AIC · ⊞ 7.8K · ◷

github-actions · 2026-08-12T21:39:18Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #52210 does not have the 'implementation' label and has 0 new lines of code in business logic directories (threshold: 100).

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-08-12T21:39:21Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-08-12T21:39:22Z

✅ PR Code Quality Reviewer completed the code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

api.individual.githubcopilot.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.individual.githubcopilot.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-08-12T21:39:36Z

❌ Ponytail Reviewer failed. Please review the logs for details.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Generated by Ponytail Reviewer for #52210

github-actions · 2026-08-12T21:39:53Z

✅ Test Quality Sentinel completed test quality analysis.

🧪 Test quality analysis by Test Quality Sentinel

Copilot · 2026-08-13T10:01:52Z

@copilot Please inspect the latest branch state, refresh the branch if needed, and run the skill before handing this PR back to maintainers.

No failed checks were included in the compact candidate s...

Re-ran the pr-finisher pass on the refreshed branch — still merge-ready.

✅ Mergeable — the automatic branch update landed: main advanced to b2ef1f3 and was merged in as 6abccad. HEAD is now 0 behind / 6 ahead, no conflicts. Net diff vs main is unchanged: only actions/setup/js/awf_reflect.cjs (+52) and actions/setup/js/awf_reflect.test.cjs (+49).
✅ Reviews — no unresolved review threads.
✅ Checks (local) — after the merge: make fmt, make recompile (285/285 workflows, no .lock.yml drift), make lint, make test-unit all pass with a clean working tree; npx vitest run actions/setup/js/awf_reflect.test.cjs → 63/63 pass.
✅ Tooling drift — checked the newly merged commits for package.json / package-lock.json / go.mod / go.sum / Makefile changes; none, so no reinstall was needed.
✅ Checks (CI) — no failed checks in the candidate set for this run.

No code changes were needed, so nothing was pushed. No remaining blockers — ready for maintainer review/merge.

gh-aw-bot · 2026-08-13T10:51:04Z

@copilot Please inspect the latest branch state, refresh the branch if needed, review any remaining blockers, and run the pr-finisher skill before handing this PR back to maintainers.

No unresolved review threads were identified in this run.
No failed checks were included in the compact candidate set.
Branch update was requested by sous-chef for run https://github.com/github/gh-aw/actions/runs/31692375821.

Generated by PR Sous Chef
_{Comment /souschef to run again}

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.7 AIC · ⌖ 5.21 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-13T10:59:55Z

@copilot Please inspect the latest branch state, refresh the branch if needed, review any remaining blockers, and run the pr-finisher skill before handing this PR back to maintainers.

No unresolved...

Ran the pr-finisher pass again. Branch is unchanged and still merge-ready on my side, but this run I inspected the PR API directly and can now name the actual blocker.

✅ Mergeable (branch) — no refresh was needed: main is still b2ef1f3 and HEAD 6abccad is 0 behind / 4 ahead, no conflicts. Net diff vs main remains actions/setup/js/awf_reflect.cjs (+52) and actions/setup/js/awf_reflect.test.cjs (+49) — 2 files, +98/−3.
✅ Reviews — no unresolved threads. Three reviews on HEAD: 2× APPROVED (Impeccable Skills Reviewer, Test Quality Sentinel 92/100) and 1× COMMENTED with 0 comments.
✅ Checks (local) — make fmt, make lint, make test-unit pass with a clean working tree; npx vitest run actions/setup/js/awf_reflect.test.cjs → 63/63 pass.
⏳ Remaining blocker — mergeable_state: blocked, but not from a failure. The commit status for 6abccad is pending with total_count: 0 (no required status has reported), and the only check run is copilot, currently in_progress (run 31692929655); its prior run on this SHA concluded success. pelikhan and gh-aw-bot are still listed as requested reviewers.

So the block is human review approval + the in-flight check, neither of which I can act on. Nothing to fix, nothing pushed — ready for maintainer review/merge.

gh-aw-bot · 2026-08-13T11:18:23Z

@copilot Triage nudge from sous-chef. Please refresh this branch as needed, review current status, and run the pr-finisher skill to move this PR toward maintainer-ready state.

Run: https://github.com/github/gh-aw/actions/runs/31694426361

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 7.86 AIC · ⌖ 3.48 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-13T11:26:24Z

@copilot Triage nudge from sous-chef. Please refresh this branch as needed, review current status, and run the pr-finisher skill to move this PR toward maintainer-ready state.

Run: https://github.c...

Ran the pr-finisher pass again — nothing changed on my side, and the only blocker is still human review.

✅ Mergeable (branch) — no refresh needed: main is still b2ef1f3, HEAD 6abccad is 0 behind / 4 ahead, no conflicts. Net diff unchanged: 2 files, +98/−3.
✅ Reviews — no unresolved threads; 2 bot approvals on HEAD.
✅ Checks (local) — make fmt, make lint, make test-unit pass with a clean working tree; npx vitest run actions/setup/js/awf_reflect.test.cjs → 63/63 pass.
✅ Checks (CI) — the copilot check that was in flight last pass has since concluded success (run 31692929655). Two successful copilot runs on this SHA now, plus a third in_progress (run 31694921544) started by this sous-chef nudge. No failures.
⏳ Blocker — mergeable_state: blocked with pelikhan and gh-aw-bot still listed as requested reviewers. This needs a human approval; there is nothing further I can do in code or CI.

Repeated sous-chef nudges won't change this state. Handing back to maintainers for review/merge.

gh-aw-bot · 2026-08-13T11:44:29Z

@copilot Triage nudge from sous-chef. The branch looks healthy; if the only blocker is human review, please leave a concise pr-finisher handoff and avoid further no-op reruns.

Run: https://github.com/github/gh-aw/actions/runs/31696345716

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 23.5 AIC · ⌖ 5.46 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-13T11:49:07Z

@copilot Triage nudge from sous-chef. The branch looks healthy; if the only blocker is human review, please leave a concise pr-finisher handoff and avoid further no-op reruns.

Run: https://github.c...

Final pr-finisher handoff — no further reruns from me.

Branch: HEAD 6abccad, 0 behind / 4 ahead of main (b2ef1f3), no conflicts. Net diff vs main is 2 files (+98/−3): actions/setup/js/awf_reflect.cjs, actions/setup/js/awf_reflect.test.cjs.
Reviews: no unresolved threads; 2 bot approvals on HEAD.
Checks: no failures; earlier curl: (56) in install_copilot_cli.sh was a transient network flake.
Blocker: human review approval only (pelikhan, gh-aw-bot still requested reviewers). Nothing actionable in code or CI.

Handing back to maintainers for review/merge.

gh-aw-bot · 2026-08-13T12:33:36Z

@copilot Triage nudge from sous-chef. The branch looks healthy; if the only blocker remains human review, please leave a concise pr-finisher handoff and avoid further no-op reruns.

No unresolved review threads were found.
No failed checks were included in the compact candidate set.
Branch update was requested by sous-chef for run https://github.com/github/gh-aw/actions/runs/31700023913.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 14.9 AIC · ⌖ 5.13 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

github-actions · 2026-08-13T12:36:31Z

PR Triage

Category: bug · Risk: high · Priority: high
Score: 84/100 (impact 42, urgency 26, quality 16)
Recommended action: fast_track

Fixes broken Copilot SDK proxy routing in docker-sbx — critical execution path. CI green. Recommended for expedited human review.

Generated by 🔧 PR Triage Agent · auto · 61.7 AIC · ⌖ 2.63 AIC · ⊞ 7.8K · ◷

pelikhan · 2026-08-13T17:23:54Z

@lpcox review

gh-aw-bot · 2026-08-13T17:49:57Z

@copilot Triage nudge from sous-chef. Please inspect the latest branch state, address any remaining review feedback, refresh the branch, and run the pr-finisher skill before handing this PR back to maintainers.

No failed checks were included in the compact candidate set.
Branch update was requested by sous-chef for run https://github.com/github/gh-aw/actions/runs/31727087804.

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 12.7 AIC · ⌖ 6.5 AIC · ⊞ 8.5K · ◷
_{Comment /souschef to run again}

Copilot · 2026-08-13T17:58:59Z

@copilot Triage nudge from sous-chef. Please inspect the latest branch state, address any remaining review feedback, refresh the branch, and run the pr-finisher skill before handing this PR back to ...

pr-finisher pass on the refreshed branch — still merge-ready, nothing to push.

Branch: the sous-chef update landed (main → merge commit aae0703); HEAD is 0 behind / 11 ahead, no conflicts. Net diff vs main is unchanged: 2 files (+98/−3) — actions/setup/js/awf_reflect.cjs, actions/setup/js/awf_reflect.test.cjs.
Checks (local, post-merge): make fmt, make lint, make recompile (285/285, no .lock.yml drift), make test-unit all pass with a clean working tree; npx vitest run actions/setup/js/awf_reflect.test.cjs → 63/63 pass.
Review feedback: no unresolved threads. @pelikhan requested a review from @lpcox, which is the only outstanding item.

Blocker remains human review approval. Handing back to maintainers.

github-actions · 2026-08-13T18:39:55Z

🔍 PR Triage

Category: bug · Risk: medium · Priority score: 66/100 (impact 25, urgency 22, quality 19)
Recommended action: fast_track

Score breakdown:

Impact: Fixes daily security-audit workflow failure caused by Copilot SDK requests resolving api-proxy to localhost inside docker-sbx.
Urgency: High — actively breaking a scheduled security-audit workflow.
Quality: APPROVED reviews (x2); CI data sparse (1 check reported) but change is small and targeted (+98/-3, 2 files).

Recommend expedited review to restore the daily security-audit workflow.

Generated by 🔧 PR Triage Agent · auto · 71.4 AIC · ⌖ 2.63 AIC · ⊞ 7.8K · ◷

Initial plan

da8df17

Copilot AI assigned Copilot and pelikhan Aug 12, 2026

Copilot started work on behalf of pelikhan August 12, 2026 03:23 View session

Copilot AI linked an issue Aug 12, 2026 that may be closed by this pull request

[aw] Daily action/setup/* Security Audit failed #52205

Closed

Fix copilot sdk api proxy bridge

f4f8242

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix daily action/setup security audit failure~~ Fix Copilot SDK API proxy routing in docker-sbx Aug 12, 2026

Copilot finished work on behalf of pelikhan August 12, 2026 03:36

Copilot AI requested a review from pelikhan August 12, 2026 03:36

github-actions Bot added pr-action:fast_track pr-agent:copilot pr-priority:high pr-risk:medium pr-type:bug labels Aug 12, 2026

github-actions Bot mentioned this pull request Aug 12, 2026

[PR Triage Report] PR Triage Report — 8 Copilot PRs (run 31570820646) #52252

Closed

github-actions Bot mentioned this pull request Aug 12, 2026

[PR Triage Report] PR Triage Report — 2026-08-12 #52293

Closed

github-actions Bot added the pr-priority:medium label Aug 12, 2026

github-actions Bot mentioned this pull request Aug 12, 2026

[PR Triage Report] PR Triage Report — 2026-08-12 #52339

Closed

pelikhan marked this pull request as ready for review August 12, 2026 21:38

Copilot AI balanced review requested due to automatic review settings August 12, 2026 21:38

Copilot started reviewing on behalf of pelikhan August 12, 2026 21:38 View session

github-actions Bot added the needs-review label Aug 12, 2026

Merge branch 'main' into copilot/aw-fix-security-audit-failure

6abccad

Copilot started work on behalf of gh-aw-bot August 13, 2026 09:52 View session

Copilot finished work on behalf of gh-aw-bot August 13, 2026 10:02

Copilot started work on behalf of gh-aw-bot August 13, 2026 10:51 View session

Copilot finished work on behalf of gh-aw-bot August 13, 2026 11:00

Copilot started work on behalf of gh-aw-bot August 13, 2026 11:18 View session

Copilot finished work on behalf of gh-aw-bot August 13, 2026 11:26

Copilot started work on behalf of gh-aw-bot August 13, 2026 11:44 View session

Copilot finished work on behalf of gh-aw-bot August 13, 2026 11:49

Copilot started work on behalf of gh-aw-bot August 13, 2026 12:33 View session

github-actions Bot added the pr-risk:high label Aug 13, 2026

github-actions Bot mentioned this pull request Aug 13, 2026

[PR Triage Report] PR Triage Report — 2026-08-13 (Run 31700054914) #52496

Closed

Copilot finished work on behalf of gh-aw-bot August 13, 2026 12:38

Merge branch 'main' into copilot/aw-fix-security-audit-failure

aae0703

Copilot started work on behalf of gh-aw-bot August 13, 2026 17:50 View session

Copilot finished work on behalf of gh-aw-bot August 13, 2026 17:59

github-actions Bot mentioned this pull request Aug 13, 2026

[PR Triage Report] PR Triage Report — 2026-08-13 (Run 31730872872) #52545

Open

Uh oh!

Conversation

Copilot AI commented Aug 12, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 12, 2026

Triage: pr-type:bug · pr-risk:medium · Score 69/100 (impact 30, urgency 25, quality 14)

Uh oh!

github-actions Bot commented Aug 12, 2026

Triage

Uh oh!

github-actions Bot commented Aug 12, 2026

PR Triage

Uh oh!

github-actions Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI commented Aug 13, 2026

Uh oh!

gh-aw-bot commented Aug 13, 2026

Uh oh!

Copilot AI commented Aug 13, 2026

Uh oh!

gh-aw-bot commented Aug 13, 2026

Uh oh!

Copilot AI commented Aug 13, 2026

Uh oh!

gh-aw-bot commented Aug 13, 2026

Uh oh!

Copilot AI commented Aug 13, 2026

Uh oh!

gh-aw-bot commented Aug 13, 2026

Uh oh!

github-actions Bot commented Aug 13, 2026

PR Triage

Uh oh!

pelikhan commented Aug 13, 2026

Uh oh!

gh-aw-bot commented Aug 13, 2026

Uh oh!

Copilot AI commented Aug 13, 2026

Uh oh!

github-actions Bot commented Aug 13, 2026

🔍 PR Triage

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Aug 12, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Aug 12, 2026 •

edited

Loading

github-actions Bot commented Aug 12, 2026 •

edited

Loading

github-actions Bot commented Aug 12, 2026 •

edited

Loading

github-actions Bot commented Aug 12, 2026 •

edited

Loading

github-actions Bot commented Aug 12, 2026 •

edited

Loading