Feature Request: OIDC authentication for BYOK model provider (engine.auth)

[ericstj]

Problem

The Copilot BYOK mode requires static credentials via COPILOT_PROVIDER_API_KEY or COPILOT_PROVIDER_BEARER_TOKEN sourced from ${{ secrets.* }}. This doesn't work with Azure OpenAI deployments that have API key authentication disabled (Entra-only), which is a security best practice recommended by Microsoft.

The MCP Gateway already supports OIDC authentication via auth: { type: github-oidc } (PR gh-aw-mcpg#2878, issues #23566, #25224, #25646). The same capability is needed for the BYOK model provider (api-proxy sidecar).

Current Behavior

yaml engine: env: COPILOT_PROVIDER_BASE_URL: https://my-resource.openai.azure.com COPILOT_PROVIDER_TYPE: azure COPILOT_MODEL: gpt-4.1 COPILOT_PROVIDER_API_KEY: ${{ secrets.AZURE_OPENAI_KEY }} # requires a static key

This fails for Entra-only Azure OpenAI deployments because there is no static API key to store — authentication requires short-lived Azure AD tokens acquired via OIDC federation.

Proposed Solution

Add OIDC authentication support to the BYOK api-proxy, similar to what the MCP Gateway already implements:

`yaml
permissions:
id-token: write

engine:
env:
COPILOT_PROVIDER_BASE_URL: https://my-resource.openai.azure.com
COPILOT_PROVIDER_TYPE: azure
COPILOT_MODEL: gpt-4.1
auth:
type: github-oidc
audience: https://cognitiveservices.azure.com
`

The api-proxy would:

1. Use ACTIONS_ID_TOKEN_REQUEST_URL / ACTIONS_ID_TOKEN_REQUEST_TOKEN (already forwarded to containers per MCP Gateway container missing ACTIONS_ID_TOKEN_REQUEST_URL / ACTIONS_ID_TOKEN_REQUEST_TOKEN env vars #25224/Compiler does not forward OIDC env vars to MCP Gateway docker run command #25646)
2. Mint a GitHub OIDC token with the specified audience
3. Exchange it for an Azure AD token via workload identity federation
4. Use the resulting bearer token for upstream requests to the provider
5. Refresh automatically before expiry

Why This Matters

• Azure OpenAI's security guidance recommends disabling API keys and using Entra-only auth
• Organizations with compliance requirements often mandate no long-lived secrets
• The OIDC plumbing already exists in gh-aw (MCP Gateway) — this extends it to the model provider
• Enables BYOK with Azure OpenAI without compromising on zero-secret security posture

Workaround Attempted

We tried using copilot-setup-steps.yml to mint an OIDC token and export COPILOT_PROVIDER_BEARER_TOKEN via GITHUB_ENV, but that file is a Copilot coding agent feature and is not executed by gh-aw. The on.steps: frontmatter runs in pre_activation which lacks id-token: write permission.

Environment

• gh-aw with Copilot engine, BYOK mode
• Azure OpenAI with API keys disabled (Entra-only)
• Federated credential configured for the repository's OIDC identity

[lpcox]

🔗 AWF tracking issue: https://github.com/github/gh-aw-firewall/issues/github/gh-aw-firewall#2544

Generated by Firewall Issue Dispatcher · ● 514.2K · ◷

[lpcox]

🔗 AWF tracking issue: https://github.com/github/gh-aw-firewall/issues/github/gh-aw-firewall#2667

Generated by Firewall Issue Dispatcher · ● 1.2M · ◷

[pelikhan]

@copilot review awf tracking issue and update docs on configuring Azure OIDC. https://github.com/github/gh-aw-firewall/issues/github/gh-aw-firewall#2667