Skip to content

Copilot/convert cli proxy to byok#2062

Merged
lpcox merged 14 commits intomainfrom
copilot/convert-cli-proxy-to-byok
Apr 18, 2026
Merged

Copilot/convert cli proxy to byok#2062
lpcox merged 14 commits intomainfrom
copilot/convert-cli-proxy-to-byok

Conversation

@lpcox
Copy link
Copy Markdown
Collaborator

@lpcox lpcox commented Apr 17, 2026

No description provided.

lpcox and others added 11 commits April 17, 2026 08:07
@lpcox
feat: convert remaining cli-proxy workflows to byok-copilot
83e6def 
Convert firewall-issue-dispatcher, smoke-copilot, and smoke-services
from features.cli-proxy to features.byok-copilot.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@lpcox
feat: add cli-proxy/byok-copilot features to all workflows
b4436ff 
- Copilot engine workflows: byok-copilot: true
- Non-copilot engine workflows (claude, codex, opencode): cli-proxy: true

All 29 workflows now have explicit feature flags for proxy support.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@lpcox
fix: increase smoke-services timeout from 5 to 15 minutes
6367d75 
The agent was timing out at 5 minutes with Redis + PostgreSQL services.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@lpcox
Update .github/workflows/smoke-copilot.lock.yml
e73a18b 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@lpcox
Update .github/workflows/smoke-services.lock.yml
731e68d 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@lpcox
Update .github/workflows/firewall-issue-dispatcher.lock.yml
cf1f942 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@lpcox
Revert "Update .github/workflows/firewall-issue-dispatcher.lock.yml"
85b1e6c 
This reverts commit cf1f942.
@lpcox
Revert "Update .github/workflows/smoke-services.lock.yml"
3ab4204 
This reverts commit 731e68d.
@lpcox
Revert "Update .github/workflows/smoke-copilot.lock.yml"
99b32e3 
This reverts commit e73a18b.
@lpcox
chore: bump mcpg to v0.2.23 in all lock files
95e9bd9 
Update ghcr.io/github/gh-aw-mcpg from v0.2.22 to v0.2.23 across all 29
workflow lock files. This picks up the DIFC proxy fix for /api/graphql
404 errors on github.com repos.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@lpcox
fix: add DIFC proxy CA trust env vars to build-test lock.yml
0328a53 
Update build-test.lock.yml to mcpg v0.2.24 and export SSL trust
environment variables (GIT_SSL_CAINFO, SSL_CERT_FILE, NODE_EXTRA_CA_CERTS,
CURL_CA_BUNDLE, REQUESTS_CA_BUNDLE) before the AWF command so that
git/curl/node inside the container trust the DIFC proxy's TLS certificate.

This fixes the 'SSL certificate problem: unable to get local issuer
certificate' error that caused all 18 gh repo clone operations to fail
in the Build Test Suite.

Refs: gh-aw-mcpg#4041, gh-aw-mcpg#4042

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 17, 2026 23:15
@lpcox lpcox requested a review from Mossaka as a code owner April 17, 2026 23:15
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 17, 2026 •
edited
Loading

✅ Coverage Check Passed

Overall Coverage

Metric Base PR Delta
Lines 84.33% 84.41% 📈 +0.08%
Statements 83.56% 83.64% 📈 +0.08%
Functions 87.39% 87.39% ➡️ +0.00%
Branches 74.78% 74.82% 📈 +0.04%
📁 Per-file Coverage Changes (1 files)
File Lines (Before → After) Statements (Before → After)
src/docker-manager.ts 86.8% → 87.1% (+0.30%) 86.4% → 86.7% (+0.29%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot AI reviewed Apr 17, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates a large set of agentic workflow sources (.md) and their compiled lock workflows (.lock.yml) to shift Copilot-based runs toward BYOK/offline configuration (via features: byok-copilot: true), while keeping/adding cli-proxy for non-Copilot engines where needed. It also refreshes related compiled artifacts (e.g., mcpg image version bumps) and expands the maintenance workflow to support additional operations and workflow_call.

Changes:

  • Add features: byok-copilot: true across many Copilot-backed workflow sources, and adjust related compiled lock workflows (including COPILOT env defaults, timeouts, and proxy setup).
  • Enable features: cli-proxy: true for several non-Copilot workflows (OpenCode/Codex/Claude/etc.) and update corresponding lock workflows and proxy wiring.
  • Update .github/workflows/agentics-maintenance.yml to support more operations, add workflow_call, and add workflow validation + cache-memory cleanup capabilities.
Show a summary per file
File Description
.github/workflows/update-release-notes.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/test-coverage-improver.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/smoke-services.md Switches feature flag to byok-copilot; increases timeout.
.github/workflows/smoke-services.lock.yml Updates compiled workflow (mcpg bump, Copilot CLI install change, timeout, BYOK env defaults).
.github/workflows/smoke-opencode.md Enables cli-proxy feature for OpenCode workflow source.
.github/workflows/smoke-opencode.lock.yml Updates compiled OpenCode workflow (mcpg bump, adds CLI proxy lifecycle steps, difc proxy flags).
.github/workflows/smoke-copilot.md Switches feature flag to byok-copilot for Copilot smoke source.
.github/workflows/smoke-copilot.lock.yml Updates compiled Copilot workflow (mcpg bump, Copilot CLI install change, BYOK env defaults).
.github/workflows/smoke-copilot-byok.lock.yml Updates compiled BYOK Copilot workflow (mcpg bump, adds GH_TOKEN + CLI proxy lifecycle).
.github/workflows/smoke-codex.md Enables cli-proxy feature for Codex workflow source.
.github/workflows/smoke-claude.md Enables cli-proxy feature for Claude workflow source.
.github/workflows/smoke-chroot.md Enables cli-proxy feature for chroot Copilot workflow source.
.github/workflows/smoke-chroot.lock.yml Updates compiled workflow (mcpg bump, switches prompt include to cli-proxy prompt).
.github/workflows/security-review.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/security-review.lock.yml Updates compiled workflow (mcpg bump, Copilot CLI install change, proxy prompt switch).
.github/workflows/security-guard.md Enables cli-proxy feature for security-guard workflow source.
.github/workflows/secret-digger-copilot.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/secret-digger-codex.md Enables cli-proxy feature for Codex secret-digger source.
.github/workflows/secret-digger-claude.md Enables cli-proxy feature for Claude secret-digger source.
.github/workflows/plan.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/pelis-agent-factory-advisor.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/issue-monster.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/issue-monster.lock.yml Updates compiled workflow (mcpg bump, Copilot CLI install change, BYOK env defaults).
.github/workflows/issue-duplication-detector.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/firewall-issue-dispatcher.md Switches feature flag to byok-copilot for the workflow source.
.github/workflows/firewall-issue-dispatcher.lock.yml Updates compiled workflow (mcpg bump, Copilot CLI install change, BYOK env defaults).
.github/workflows/doc-maintainer.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/dependency-security-monitor.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/copilot-token-usage-analyzer.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/copilot-token-usage-analyzer.lock.yml Updates compiled workflow (mcpg bump, Copilot CLI install change, BYOK env defaults).
.github/workflows/copilot-token-optimizer.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/copilot-token-optimizer.lock.yml Updates compiled workflow (mcpg bump, Copilot CLI install change, BYOK env defaults).
.github/workflows/cli-flag-consistency-checker.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/cli-flag-consistency-checker.lock.yml Updates compiled workflow (mcpg bump, Copilot CLI install change, BYOK env defaults).
.github/workflows/claude-token-usage-analyzer.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/claude-token-usage-analyzer.lock.yml Updates compiled workflow (mcpg bump, Copilot CLI install change, BYOK env defaults).
.github/workflows/claude-token-optimizer.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/claude-token-optimizer.lock.yml Updates compiled workflow (mcpg bump, Copilot CLI install change, BYOK env defaults).
.github/workflows/ci-doctor.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/ci-doctor.lock.yml Updates compiled workflow (mcpg bump, Copilot CLI install change, BYOK env defaults).
.github/workflows/ci-cd-gaps-assessment.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/build-test.md Adds byok-copilot feature flag to the workflow source.
.github/workflows/agentics-maintenance.yml Expands maintenance operations, adds workflow_call, and adds validation + cache-memory cleanup jobs.
.github/aw/actions-lock.json Adds a lock entry for github/gh-aw-actions/setup-cli@v0.68.7.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 1/1 changed files
  • Comments generated: 0

@github-actions

This comment has been minimized.

Sign in to view
@github-actions

This comment has been minimized.

Sign in to view
@github-actions

This comment has been minimized.

Sign in to view
@github-actions

This comment has been minimized.

Sign in to view
@github-actions

This comment has been minimized.

Sign in to view
@github-actions github-actions bot mentioned this pull request Apr 17, 2026
Closed
@lpcox
fix: add GIT_SSL_CAINFO to cli-proxy sidecar for git clone SSL trust
1f2d1ee 
The cli-proxy entrypoint sets SSL_CERT_FILE (for Go's gh CLI) and
NODE_EXTRA_CA_CERTS (for Node.js), but when `gh repo clone` shells out
to `git`, it uses OpenSSL which reads GIT_SSL_CAINFO — not SSL_CERT_FILE.

Changes:
- Add GIT_SSL_CAINFO export pointing to the combined CA bundle in
  containers/cli-proxy/entrypoint.sh
- Add GIT_SSL_CAINFO to PROTECTED_ENV_KEYS in server.js to prevent
  agent override of the TLS trust store
- Remove unnecessary SSL env var exports from build-test.lock.yml
  (those were in the agent container, but git runs in the cli-proxy)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 17, 2026

Smoke Test Results

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude

@github-actions

This comment has been minimized.

Sign in to view
@github-actions

This comment has been minimized.

Sign in to view
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 17, 2026

Smoke Test: GitHub Actions Services Connectivity ✅

Check Result
Redis PING (host.docker.internal:6379) ✅ PONG
PostgreSQL pg_isready (host.docker.internal:5432) ✅ accepting connections
PostgreSQL SELECT 1 (smoketest db, user postgres) ✅ returned 1

All checks passed.

🔌 Service connectivity validated by Smoke Services

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 17, 2026

Chroot Version Comparison Results

Runtime Host Version Chroot Version Match?
Python Python 3.12.13 Python 3.12.3 ❌ NO
Node.js v24.14.1 v20.20.2 ❌ NO
Go go1.22.12 go1.22.12 ✅ YES

Overall: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot.

Tested by Smoke Chroot

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 17, 2026

🏗️ Build Test Suite Results

Ecosystem Project Build/Install Tests Status
Bun elysia ✅ 1/1 passed ✅ PASS
Bun hono ✅ 1/1 passed ✅ PASS
C++ fmt ✅ N/A ✅ PASS
C++ json ✅ N/A ✅ PASS
Deno oak N/A 1/1 passed ✅ PASS
Deno std N/A 1/1 passed ✅ PASS
.NET hello-world ✅ N/A ✅ PASS
.NET json-parse ✅ N/A ✅ PASS
Go color ✅ 1/1 passed ✅ PASS
Go env ✅ 1/1 passed ✅ PASS
Go uuid ✅ 1/1 passed ✅ PASS
Java gson ✅ 1/1 passed ✅ PASS
Java caffeine ✅ 1/1 passed ✅ PASS
Node.js clsx ✅ All passed ✅ PASS
Node.js execa ✅ All passed ✅ PASS
Node.js p-limit ✅ All passed ✅ PASS
Rust fd ✅ 1/1 passed ✅ PASS
Rust zoxide ✅ 1/1 passed ✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #2062 · ● 487.9K · ◷

@lpcox
chore: increase Security Guard max-turns from 8 to 12
aa56f7e 
The agent was hitting the max turns limit and exiting with code 1
before completing its review.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@lpcox lpcox merged commit 735a7f8 into main Apr 18, 2026
@lpcox lpcox deleted the copilot/convert-cli-proxy-to-byok branch April 18, 2026 00:24
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 18, 2026

Smoke Test Results — @lpcox

Test Result
GitHub MCP (list_pull_requests) — PR: "Copilot/convert cli proxy to byok" ✅
GitHub.com connectivity (HTTP 200) ✅
File write/read (smoke-test-copilot-24593072788.txt) ✅

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 18, 2026

Smoke Test: Copilot BYOK (Offline Mode) — PASS ✅

Test Result
GitHub MCP (list merged PRs) ✅ PR #2062 "Copilot/convert cli proxy to byok"
GitHub.com connectivity ✅ HTTP 200
File write/read ✅ "BYOK smoke test passed at Sat Apr 18 01:02:17 UTC 2026"
BYOK inference (this response) ✅

Running in BYOK offline mode (COPILOT_OFFLINE=true) via api-proxy → api.githubcopilot.com

Author: @lpcox

🔑 BYOK report filed by Smoke Copilot BYOK

This was referenced Apr 18, 2026
Merged
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@Mossaka Mossaka Awaiting requested review from Mossaka Mossaka is a code owner

Assignees

No one assigned

Labels

build-test smoke-claude smoke-copilot smoke-copilot-byok smoke-services

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lpcox