Add `engine.auth` OIDC support for Copilot BYOK model provider by Copilot · Pull Request #30732 · github/gh-aw

Copilot · 2026-05-07T03:15:44Z

Copilot BYOK currently requires static provider credentials (COPILOT_PROVIDER_API_KEY / COPILOT_PROVIDER_BEARER_TOKEN), which blocks Entra-only Azure OpenAI deployments that rely on short-lived OIDC-based auth. This change adds engine.auth support so BYOK provider auth can be configured as github-oidc.

Engine config parsing
- Added engine.auth parsing on EngineConfig (type, audience), using the existing MCP auth shape.
- Supports frontmatter like:
  - engine.auth.type: github-oidc
  - engine.auth.audience: https://cognitiveservices.azure.com
Copilot BYOK runtime wiring
- When engine.auth is present, Copilot execution now exports:
  - AWF_AUTH_TYPE
  - AWF_AUTH_AUDIENCE
- These are passed through to the AWF api-proxy path used by BYOK routing.
Schema + docs updates
- Extended main_workflow_schema.json to allow engine.auth in engine object config.
- Updated engine reference docs with a concise Azure OIDC BYOK example and required id-token: write permission.
Focused coverage
- Added tests for:
  - engine.auth extraction from frontmatter
  - propagation into Copilot execution env (AWF_AUTH_TYPE / AWF_AUTH_AUDIENCE)
  - compile-path handling of object-form engine config with auth

permissions:
  id-token: write

engine:
  id: copilot
  auth:
    type: github-oidc
    audience: https://cognitiveservices.azure.com
  env:
    COPILOT_PROVIDER_BASE_URL: https://my-resource.openai.azure.com
    COPILOT_PROVIDER_TYPE: azure
    COPILOT_MODEL: gpt-4.1

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name k (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw er_test (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name (http block)
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name ath ../../../.pr**/*.json git _modules/.bin/sh../../../.prettierignore ithub-script/gitsh git bject.type] | @t"prettier" --write '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' ---errorsas git er ../pkg/workflow/js/**/*.json' --ignore-path ../../../.prettierignore git sv /ref/tags/v9 infocmp sv git (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linuTest commit /usr/bin/git 23 -trimpath ache/node/24.14.--show-toplevel git rev-�� --show-toplevel infocmp /usr/bin/git bility_SameInputgh -goversion ache/go/1.25.8/x/repos/actions/github-script/git/ref/tags/v9 git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 node sv run format:pkg-json /opt/hostedtoolc/repos/actions/github-script/git/ref/tags/v9.0.0 git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x-f /usr/bin/git -bool -buildtags /usr/bin/git git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 64/pkg/tool/linu-extld=gcc sv (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 64/pkg/tool/linux_amd64/link sv l gh h git rev-�� --show-toplevel git /usr/bin/gh '**/*.ts' '**/*.git node 8d519d9/node_mod--show-toplevel gh (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv 3055-14967/test-2269394291 -buildtags 1/x64/bin/node -errorsas -ifaceassert -nilfunc e/git t-ha�� ithub/workflows/agent-performance-analyzer.md tname) 1/x64/bin/node h ../../../.pretinfocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 git bject.type] | @tsv --show-toplevel l ache/node/24.14.--show-toplevel git rev-�� --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git uts.enforce_all git config /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/git xterm-color ache/go/1.25.8/xrev-parse /usr/bin/git git rev-�� /ref/tags/v9 git sv --show-toplevel ache/go/1.25.8/xrev-parse /usr/bin/gh gh (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv bility_SameInputSameOutput1827230516/001/stability-test.md -importcfg o.git -s -w -buildmode=exe ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet unpa�� --pack_header=2,3 -q ache/node/24.14.1/x64/bin/node on' --ignore-patgit (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv v1.0.0 rev-parse ache/node/24.14.1/x64/bin/node ./../pkg/workflogit (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260507-033055-14967/test-916469069/custom/workflows rev-parse me: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } '**/*.ts' '**/*.git (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/TestCompilegh config (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv d -n 10 (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv to pkg/actionpins/data/action_pins.json and pkg/workflow/data/action_pins.json..." (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv r (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv github/workflows -nolocalimports -importcfg /tmp/go-build3332622451/b408/importcfg -embedcfg /tmp/go-build3332622451/b408/embedcfg -pack (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/xconfig /usr/bin/gh 3816942640 -buildtags 2622451/b435=> gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git faultBranchFromLgit faultBranchFromLrev-parse ache/node/24.14.--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/go/1.25.8/x64/pkg/tool/linu--json /usr/bin/gh SameOutput314303gh bin/linux-x64/rgapi .cfg gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git prettier =main ache/go/1.25.8/x--show-toplevel git (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv rhysd/actionlint:latest /tmp/go-build3332622451/b461/_testmain.go /usr/bin/git */*.json' '!../.git --local x_amd64/vet git -C /tmp/gh-aw-test-runs/20260507-033055-14967/test-3816942640 rev-parse /usr/bin/git @{u} .cfg 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcremote.origin.url /usr/bin/infocmp k/gh-aw/gh-aw /tmp/go-build333-1 e/git-upload-pacxterm-color infocmp -1 xterm-color /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /usr/bin/git -unreachable=falgit /tmp/go-build333rev-parse /opt/hostedtoolc--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel /tmp/go-build3332622451/b446/sliceutil.test /usr/bin/git -test.paniconexigit -test.v=true /usr/bin/git git rev-�� /ref/tags/v9 git sv /tmp/gh-aw-test-infocmp config om/owner/repo.gixterm-color gh (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv runs/20260507-033055-14967/test-2269394291 (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv k/gh-aw/gh-aw/.github/workflows/archie.md remote /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link ./../pkg/workflogit (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 remote sv '**/*.ts' '**/*.git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv g_.a x_amd64/vet /usr/bin/git --get-regexp --global x_amd64/vet git -C 29ckNxE1z remote bject.type] | @tsv *.json' '!../../git --local 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv xterm-color gh /usr/bin/git iant-2926860932/git --jq ode_modules/.bin--show-toplevel git rev-�� --show-toplevel git e/git-remote-https --show-toplevel infocmp _modules/.bin/sh--show-toplevel e/git-remote-https (http block)
https://api.github.com/repos/aws-actions/configure-aws-credentials/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git /tmp/go-build333git -trimpath /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel node /usr/bin/git /tmp/TestHashCongh -goversion /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git (http block)
- Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/gh-aw-test-git rev-parse /usr/bin/git git rev-�� /ref/tags/v9 git sv --get remote.origin.urauth om/myorg/repo.gistatus gh (http block)
https://api.github.com/repos/azure/login/git/ref/tags/v2
- Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel /opt/hostedtoolcache/go/1.25.8/x--jq /usr/bin/git /tmp/go-build333git -trimpath /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --get l /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git uts.enforce_all git -pack /usr/bin/infocmp--show-toplevel git rev-�� --show-toplevel infocmp /usr/bin/git /ref/tags/v9 git sv git (http block)
https://api.github.com/repos/docker/login-action/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git uts.enforce_all git config /usr/bin/git git rev-�� --show-toplevel git /usr/bin/infocmp /ref/tags/v9 x_amd64/vet sv infocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/git xterm-color (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/gh SameOutput182723gh /tmp/go-build333api e/git gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git -unreachable=falinfocmp /tmp/go-build333-1 2622451/b443/semxterm-color git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/gh 1458303352 on .cfg gh api /repos/actions/github-script/git/ref/tags/v9 --jq /usr/bin/git ithub/workflows infocmp bject.type] | @txterm-color git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv --get remote.origin.url /usr/bin/git .js' --ignore-pagit --local x_amd64/vet git conf�� --get resolved$ /usr/bin/git get --local 64/pkg/tool/linu--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv bject.type] | @t/tmp/TestParseDefaultBranchFromLsRemoteWithRealGitbranch_with_hyphen2452027103/0git infocmp /usr/bin/git 1751846494/.githgit git 1/x64/bin/npx git rev-�� --show-toplevel gh r,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,disp--show-toplevel th .prettierignogit flow son git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv f/tags/v999.999.999 x_amd64/vet sv .js' --ignore-pagit (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv f/tags/v999.999.999 Test User sv */*.ts' '**/*.jsgit git /usr/bin/git git rev-�� --show-toplevel git me: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } th .prettierignogit flow-12345 ode_modules/.bin--show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-30 (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-07 (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-02-06 (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name go ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 2622451/b026/vet.cfg ortcfg.link ./../.prettieriggit (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name --jq 64/pkg/tool/linux_amd64/vet --show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name on ache/go/1.25.8/x64/pkg/tool/linu-lang=go1.25 /../../.prettiergit erignore (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 on ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettier/usr/bin/git erignore th: .path, creat-v ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name stmain.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/link rkflow/js/**/*.jgit --jq erignore ache/go/1.25.8/x64/pkg/tool/linux_amd64/link tion�� --noprofile git son ignore git sv sh (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1234567890
- Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, (http block)
- Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, xterm-color git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name on ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettiergit erignore (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 on ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /../../.prettier/opt/hostedtoolcache/node/24.14.1/x64/bin/node erignore (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name --jq 1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/node rkflow/js/**/*.jgit git erignore ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url tion�� 2329301/b001/workflow.test git son ignore git /usr/bin/grep eGLt8VbqweWFk/OdIPKGgHosDFiqy7qfremote.origin.url (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 2622451/b021/vet.cfg .cfg ./../.prettieriggit (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name git 64/pkg/tool/linux_amd64/vet /ref/tags/v9 git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 2622451/b029/vet.cfg ache/go/1.25.8/x64/pkg/tool/linu-importcfg ./../.prettieriggit (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name --jq 64/pkg/tool/linux_amd64/vet export GOROOT="//opt/hostedtoolcache/node/24.14.1/x64/bin/node git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name .cfg 64/pkg/tool/linux_amd64/compile (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 2622451/b022/vet.cfg .cfg ./../.prettieriggit (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name git 64/pkg/tool/linux_amd64/link --show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name .cfg nutil.test (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 2622451/b030/vet.cfg ache/go/1.25.8/x64/pkg/tool/linu-lang=go1.25 ./../.prettieriggit (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name git 64/pkg/tool/linux_amd64/vet --show-toplevel git ode-gyp-bin/node--get-regexp 64/pkg/tool/linu^remote\..*\.gh-resolved$ -c log.showsignature=false log k/gh-aw/node_modules/.bin/node -n1 --format=format:config --end-of-optionsuser.email node (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 (http block)
https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
- Triggering command: /tmp/go-build3332622451/b405/cli.test /tmp/go-build3332622451/b405/cli.test -test.testlogfile=/tmp/go-build3332622451/b405/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true (http block)
- Triggering command: /tmp/go-build1437586799/b405/cli.test /tmp/go-build1437586799/b405/cli.test -test.testlogfile=/tmp/go-build1437586799/b405/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true --show-toplevel git /usr/bin/git gh api (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel gh /usr/bin/git /repos/actions/gdu --jq rue,"errors":[],/tmp/gh-aw/aw-feature-branch.patch git rev-�� --show-toplevel gh /usr/bin/infocmp /repos/github/ghgit (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git --show-toplevel eloper-action-ma-k rue,"errors":[],/tmp/gh-aw/aw-feature-branch.patch git rev-�� --show-toplevel git /usr/bin/git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv sRemoteWithRealGitmaster_branch3267598727/001 sRemoteWithRealGitmaster_branch3267598727/002/work g_.a (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv */*.ts' '**/*.js-c=4 --global x_amd64/vet http.https://gitgit (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 git bject.type] | @tsv --show-toplevel infocmp /usr/bin/infocmp-bool git ode_�� tted" infocmp p/bin/bash xterm-color git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv */*.ts' '**/*.js--exclude-hidden=receive --global x_amd64/vet http.https://gitnode (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv get --global x_amd64/vet http.https://gitgit (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv --get-regexp --global x_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv */*.ts' '**/*.json' --ignore-pat-errorsas --global x_amd64/vet http.https://gitgit (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv /repos/actions/ggo1.25.8 --jq node /ref/tags/v9 git sv git ode_�� --show-toplevel ker/cli-plugins/docker-compose 64/bin/go xterm-color git /usr/bin/git time/copilot-devremote (http block)
https://api.github.com/repos/google-github-actions/auth/git/ref/tags/v2
- Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/TestGuardPogit config /usr/bin/gh git rev-�� --show-toplevel gh /usr/bin/git /repos/actions/ggit --jq om/org2/repo.git--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 ache/node/24.14.1/x64/bin/node bject.type] | @tsv orce_all)' rev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/gh --show-toplevel Km5Q_ECldW7E om/org1/repo.git--show-toplevel gh (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv 1972814536/001 2622451/b225/vet.cfg ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet cmd/gh-aw/versio/usr/bin/git internal/tools/aconfig internal/tools/g--get-regexp ache/go/1.25.8/x^remote\..*\.gh-resolved$ ortc�� 3055-14967/test-2967474619/.github/workflows stmain.go ingutil.test --ignore-path ../../../.prettirev-parse (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv "prettier" --write '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore conntrack in/sh INVALID,NEW -j ode-gyp-bin/nodelist sh -c te 'scripts/**/*--workflow gh k/gh-aw/gh-aw/ac--limit /repos/actions/ggh --jq /usr/bin/infocmp/repos/actions/github-script/git/ref/tags/v9 bash (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --show-toplevel git /usr/bin/git node /opt�� 01/inlined-b.md --write ck **/*.ts **/*.json --ignore-path /bin/sh (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo es/.bin/sh (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo n-dir/git (http block)
- Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state g_.a **/*.ts **/*.json --ignore-path ache/go/1.25.8/x64/pkg/tool/linu/tmp/go-build3332622451/b457/_testmain.go -c agent-persona-explorer.md (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name on' --ignore-pat-errorsas (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name ath ../../../.pr**/*.json git ode_modules/.bin../../../.prettierignore ithub-script/gitsh git bject.type] | @t"prettier" --write '../../../**/*.json' '!../../../pkg/workflow/js/**/*.json' ---test.timeout=10m0s git er ../pkg/workflow/js/**/*.json' --ignore-path ../../../.prettierignore git (http block)
https://api.github.com/repos/test/repo
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch t1518875862 **/*.cjs .yml **/*.json --ignore-path ../../../.pretti--show-toplevel ortcfg -c g/cli/spec_test.go (http block)
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch 01/noflag-a.md --write ache/node/24.14.1/x64/lib/node_modules/npm/node_modules/@npmcli/run-script/lib/node-gyp-bin/nodedownload **/*.ts **/*.json --ignore-path node k/gh�� run format:pkg-json k/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/sh tierignore --jq erignore bash (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/03e5562c-d5d2-42ca-9123-ce26a148bd68 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-05-07T05:13:17Z

@copilot review plan with awf configuration specifications and documentation

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/adbe2fe9-9c03-4df5-9c80-db00a3816e0e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-07T06:39:51Z

@copilot review plan with awf configuration specifications and documentation

Updated in cfe455e. I reviewed the AWF configuration expectations and expanded the BYOK OIDC docs to include the explicit engine.auth → AWF mapping (type→AWF_AUTH_TYPE, audience→AWF_AUTH_AUDIENCE), clarified that only github-oidc is supported, and documented the id-token: write requirement for GitHub OIDC token acquisition.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
- Triggering command: /usr/bin/gh gh repo view --json owner,name --jq .owner.login + "/" + .name rkflow/js/**/*.json /../../.prettiergh erignore (http block)
- Triggering command: /usr/bin/gh gh repo view owner/repo t-17�� /ref/tags/v9 (http block)
https://api.github.com/orgs/test-owner/actions/secrets
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name h ../../../.pret.prettierignore (http block)
- Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name h ../../../.prettierignore git /usr/bin/gh ithub-script/gitnode git bject.type] | @t--write gh api w/js/**/*.json' --ignore-path --jq /usr/bin/infocmp --show-toplevel git /usr/bin/git infocmp (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 node sv epo}/actions/rungh scripts/**/*.js , number: .run_n/repos/actions/github-script/git/ref/tags/v9.0.0 gh api /repos/actions/checkout/git/ref/tags/v6 --jq /usr/bin/git licyBlockedUsersinfocmp (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 node sv --write scripts/**/*.js trepo.git git rev-�� --show-toplevel go /usr/bin/git -v -parallel=4 /usr/bin/git git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv /tmp/gh-aw-test-runs/20260507-063806-19780/test-4157743514 rev-parse me: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } @{u} git de_modules/.bin//repos/actions/github-script/git/ref/tags/v9 git rev-�� --show-toplevel epo}/actions/runs/12346/artifacts /usr/bin/infocmp e git 1/x64/bin/sh infocmp (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv set-url origin 1/x64/bin/node (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel ache/node/24.14.1/x64/bin/node /usr/bin/git --show-toplevel -tests /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git :latest rev-parse /usr/bin/git git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq [.object.sha, .object.type] | @tsv --show-toplevel /usr/lib/git-core/git-remote-https /usr/bin/gh REDACTED git /usr/bin/git gh api /ref/tags/v9 --jq sv runs/20260507-06git git /usr/bin/infocmp--show-toplevel infocmp (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv licyBlockedUsersCommaSeparatedCompiledOutput2922288012/001 (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv runs/20260507-063626-7520/test-530698775 (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq [.object.sha, .object.type] | @tsv /repos/actions/github-script/git/ref/tags/v9 --jq (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv -template-expressions.md (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9 --jq [.object.sha, .object.type] | @tsv re --log-level=error (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v9.0.0
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv js/**/*.json' ---errorsas (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v9.0.0 --jq [.object.sha, .object.type] | @tsv js/**/*.json' --ignore-path ../../../.prettierignore (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv test/race-image:v1.0.0 git /usr/bin/infocmp iles formatted" (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv xterm-color gh /usr/bin/git OnlyCompiledOutpinfocmp on 1/x64/bin/node git rev-�� --show-toplevel 1/x64/bin/node /usr/bin/git : ${{ github.repgit git /home/REDACTED/wor--show-toplevel git (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --get s/5/artifacts /usr/bin/git on' --ignore-patgit (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv test/concurrent-image:v1.0.0 git /usr/bin/gh ApprovalLabelsCogh on rkflow/js/**/*.j/repos/actions/github-script/git/ref/tags/v9 gh work�� list --repo /usr/bin/git --json name,path,state /home/node_modul--show-toplevel git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 git bject.type] | @tsv /tmp/gh-aw-test-git config /usr/bin/git git rev-�� --show-toplevel git /usr/bin/infocmp /tmp/compile-insinfocmp rev-parse /usr/bin/git infocmp (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv licyTrustedUsersCompiledOutput866097440/001 (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv /ref/tags/v9 initial commit sv h ../../../.pretgit (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq [.object.sha, .object.type] | @tsv runs/20260507-063626-7520/test-530698775 remote.origin.url /usr/bin/infocmp (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv /home/REDACTED/work/gh-aw/gh-aw/.github/workflows rev-parse /usr/bin/git ant-65849913/.gigit (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel gh /usr/bin/git /repos/actions/ggit --jq ode_modules/.bin--show-toplevel git remo�� /ref/tags/v9 git sv /ref/tags/v9 gh ode_modules/.bin--show-toplevel git (http block)
https://api.github.com/repos/aws-actions/configure-aws-credentials/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel node /usr/bin/git /home/REDACTED/worgit (http block)
- Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ithub-script/gitgh (http block)
- Triggering command: /usr/bin/gh gh api /repos/aws-actions/configure-aws-credentials/git/ref/tags/v4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /ref/tags/v9 l sv git rev-�� /ref/tags/v9 git sv --get remote.origin.urauth /usr/bin/git gh (http block)
https://api.github.com/repos/azure/login/git/ref/tags/v2
- Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git image:v1.0.0 remote /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git (http block)
- Triggering command: /usr/bin/gh gh api /repos/azure/login/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/gh-aw-test-git rev-parse e/git git rev-�� --show-toplevel e/git /usr/bin/git REDACTED.os git /usr/bin/git git (http block)
https://api.github.com/repos/docker/login-action/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git :latest rev-parse /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel (http block)
- Triggering command: /usr/bin/gh gh api /repos/docker/login-action/git/ref/tags/v3 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/gh-aw-test-git l /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/node/24.14.--jq /usr/bin/git secrets.TOKEN git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/infocmp Onlymin-integritgh on 1/x64/bin/node infocmp -1 xterm-color 1/x64/bin/node /usr/bin/gh == 'true' && 'fuinfocmp format:cjs /home/REDACTED/worxterm-color gh (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq [.object.sha, .object.type] | @tsv --show-toplevel infocmp /usr/bin/infocmp te '../../../**/git git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv /usr/bin/git git /usr/bin/git --show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv /usr/bin/git x_amd64/link /usr/bin/git iant-938797393/.git git /usr/bin/infocmp--show-toplevel git rev-�� /ref/tags/v9 infocmp sv lGitcustom_brancgit lGitcustom_brancrev-parse bject.type] | @t--show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/actions/runs
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-30 (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-04-07 (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --limit 100 --created >=2026-02-06 (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name user.name 1/x64/bin/node (http block)
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 committer.name ache/node/24.14.1/x64/bin/npx (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name gh bin/node /repos/github/ghgit --jq erignore git m/_n�� --show-toplevel node ache/go/1.25.8/x64/pkg/tool/linux_amd64/cgo install r /usr/bin/git ache/go/1.25.8/x64/pkg/tool/linuorigin (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name user.email es/.bin/node (http block)
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 user.name /usr/local/.ghcup/bin/git (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name --jq ache/go/1.25.8/x64/bin/sh xterm-color git /usr/bin/gh gh api DefaultBranchFromLsRemoteWithRealGitbranch_with_hyphen1670884495/001' DefaultBranchFromLsRemoteWithRealGitbranch_with_hyphen1670884495/001' e_modules/.bin/node /repos/actions/ggit --jq /usr/bin/git infocmp (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1234567890
- Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, h ../../../.pret.prettierignore (http block)
- Triggering command: /usr/bin/gh gh api repos/{owner}/{repo}/actions/runs/1234567890 --jq {databaseId: .id, number: .run_number, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPath: .path, createdAt: .created_at, startedAt: .run_started_at, updatedAt: .updated_at, event: .event, headBranch: .head_branch, h ../../../.pret.prettierignore git /usr/bin/gh ithub-script/gitgcc /opt/hostedtoolc-### bject.type] | @t-x gh api /repos/actions/g- --jq /usr/bin/infocmp /ref/tags/v9 git sv infocmp (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name user.email in/node (http block)
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 user.name 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name git ck --show-toplevel git /usr/bin/infocmpxterm-color infocmp sRem�� te 'scripts/**/*.js' --ignore-path .prettierignore --log-level=error infocmp es/.bin/node /ref/tags/v9 160fe627c8811b34rev-parse sv n_pins.json; \ echo "�� Action pins synced sucrev-parse (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name user.name c07b280e72f803545c9db35d7f69a30f6478b82fccce41756925fefd2ab0065d-d (http block)
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 committer.name .cfg (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name infocmp 1/x64/bin/node xterm-color git /opt/hostedtoolc--show-toplevel erignore t-ha�� ithub/workflows/ace-editor.md node ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet install --package-lock-o-1 /usr/bin/git ache/go/1.25.8/x64/pkg/tool/linuorigin (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name user.name .cfg (http block)
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 sRemoteWithRealGitmain_branch2446768825/002/work .cfg (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name gh .cfg /ref/tags/v9 --jq sv erignore api /js && npm run format:pkg-json --silent >/dev/null 2>&1 --jq ache/go/1.25.8/x64/pkg/tool/linux_amd64/vet --show-toplevel infocmp /usr/bin/git ache/go/1.25.8/x64/pkg/tool/linuremote.origin.url (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name pull.rebase 64/pkg/tool/linux_amd64/link (http block)
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 committer.name 1/x64/bin/node (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name infocmp ow.lock.yml xterm-color gh e/git erignore m/_n�� --show-toplevel e/git 1/x64/bin/node install r /usr/bin/git 1/x64/bin/node (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name pull.rebase 1/x64/bin/node workflow/data/acgit (http block)
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 efaultBranchFromLsRemoteWithRealGitmain_branch2446768825/001' .cfg (http block)
- Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name gh sv /ref/tags/v9 --jq sv erignore m/_n�� s/1234567890 node umber, url: .html_url, status: .status, conclusion: .conclusion, workflowName: .name, workflowPalist install r (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path h ../../../.pret.prettierignore (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 (http block)
https://api.github.com/repos/github/gh-aw/contents/.github/workflows/shared/reporting.md
- Triggering command: /tmp/go-build4274789314/b405/cli.test /tmp/go-build4274789314/b405/cli.test -test.testlogfile=/tmp/go-build4274789314/b405/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true (http block)
- Triggering command: /tmp/go-build1764818548/b405/cli.test /tmp/go-build1764818548/b405/cli.test -test.testlogfile=/tmp/go-build1764818548/b405/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true --show-toplevel node /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git ithub-script/gitdu (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq [.object.sha, .object.type] | @tsv --show-toplevel git /usr/bin/git /tmp/TestGuardPodu remote /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git /usr/bin/git gh om/owner/repo.gi--show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq [.object.sha, .object.type] | @tsv 31736889/001 31736889/002/work _modules/.bin/sh --show-toplevel git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv d-robin' (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq [.object.sha, .object.type] | @tsv json' --ignore-path ../../../.pr**/*.json git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv ant-940671758/.github/workflows (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv json' --ignore-path ../../../.pr**/*.json (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq [.object.sha, .object.type] | @tsv json' --ignore-path ../../../.pr**/*.json git sv --show-toplevel git /usr/bin/git infocmp -1 lGitbranch_with_hyphen1670884495/001' lGitbranch_with_hyphen1670884495/001' sv /ref/tags/v9 git sv git (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv json' --ignore-path ../../../.pr**/*.json (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq [.object.sha, .object.type] | @tsv iant-3397563767/.github/workflows --jq /usr/bin/gh /ref/tags/v9 git sv gh api th .prettierignore --log-level=error --jq /usr/bin/git --show-toplevel git /usr/bin/git git (http block)
https://api.github.com/repos/google-github-actions/auth/git/ref/tags/v2
- Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 git bject.type] | @tsv /tmp/gh-aw-test-git l "warnings":[]}] git rev-�� --show-toplevel /opt/hostedtoolcache/node/24.14.1/x64/bin/node /usr/bin/gh env.NODE_VERSIONgit (http block)
- Triggering command: /usr/bin/gh gh api /repos/google-github-actions/auth/git/ref/tags/v2 --jq [.object.sha, .object.type] | @tsv ithub-script/git/ref/tags/v9 node bject.type] | @tsv /home/REDACTED/worgit (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv (http block)
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq [.object.sha, .object.type] | @tsv path .prettierignore --log-level--ignore-path git /usr/bin/git ithub-script/gitgit git bject.type] | @tuser.email git rev-�� ../pkg/workflow/js/**/*.json' ---test.timeout=10m0s git 64/pkg/tool/linux_amd64/link ithub-script/gitgit git bject.type] | @t--show-toplevel 64/pkg/tool/linux_amd64/link (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion (http block)
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion --show-toplevel git ode-gyp-bin/node--show-toplevel git rev-�� /ref/tags/v9 /usr/bin/runc.original sv sv git /usr/bin/git gcc (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/git (http block)
- Triggering command: /usr/bin/gh gh workflow list --repo owner/repo --json name,path,state /home/node_modules/.bin/node (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name h ../../../.prettierignore (http block)
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name h ../../../.prettierignore --jq /usr/bin/infocmp --show-toplevel git /usr/bin/git infocmp -1 w/js/**/*.json' --ignore-path git /usr/bin/git /ref/tags/v9 git sv git (http block)
https://api.github.com/repos/test/repo
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch licyTrustedUsersCompiledOutput866097440/001 -buildtags (http block)
- Triggering command: /usr/bin/gh gh api /repos/test/repo --jq .default_branch ithub-script/git/ref/tags/v9 pkg/workflow/set_issue_type.go bject.type] | @tsv /repos/actions/ggit --jq /usr/bin/infocmp--show-toplevel node /tmp�� /tmp/TestHashConsistency_GoAndJavaScript1333028155/001/test-inlined-imports-enabled-with-body-cogit l /usr/lib/git-core/git xterm-color git /usr/bin/git /usr/lib/git-core/git (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Initial plan

aaf1155

Copilot AI assigned Copilot and pelikhan May 7, 2026

Copilot started work on behalf of pelikhan May 7, 2026 03:26 View session

Copilot AI linked an issue May 7, 2026 that may be closed by this pull request

Feature Request: OIDC authentication for BYOK model provider (engine.auth) #30260

Open

github-actions Bot mentioned this pull request May 7, 2026

Smoke Test: Claude - 25474180964 #30737

Closed

feat: support engine.auth OIDC for copilot BYOK

de73c65

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/03e5562c-d5d2-42ca-9123-ce26a148bd68 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add OIDC authentication for BYOK model provider~~ Add engine.auth OIDC support for Copilot BYOK model provider May 7, 2026

Copilot finished work on behalf of pelikhan May 7, 2026 03:43

Copilot AI requested a review from pelikhan May 7, 2026 03:43

Copilot started work on behalf of pelikhan May 7, 2026 06:31 View session

docs: align engine.auth BYOK docs with AWF auth spec mapping

cfe455e

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/adbe2fe9-9c03-4df5-9c80-db00a3816e0e Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan May 7, 2026 06:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add `engine.auth` OIDC support for Copilot BYOK model provider#30732

Add `engine.auth` OIDC support for Copilot BYOK model provider#30732
Copilot wants to merge 3 commits intomainfrom
copilot/feature-oidc-authentication-byok-provider

Copilot AI commented May 7, 2026 •

edited

Loading

Uh oh!

pelikhan commented May 7, 2026

Uh oh!

Copilot AI commented May 7, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Copilot AI commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

pelikhan commented May 7, 2026

Uh oh!

Copilot AI commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented May 7, 2026 •

edited

Loading

Copilot AI commented May 7, 2026 •

edited

Loading