Skip to content

Fix Claude engine routing for model-provider: github#46013

Open
pelikhan with Copilot wants to merge 32 commits into
mainfrom
copilot/fix-claude-configuration
Open

Fix Claude engine routing for model-provider: github#46013
pelikhan with Copilot wants to merge 32 commits into
mainfrom
copilot/fix-claude-configuration

Conversation

Copilot AI commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

When model-provider: github is set on the Claude engine, the AWF anthropic proxy sidecar was still targeting api.anthropic.com — causing 401s because it was receiving a Copilot token. The harness resolves its endpoint from /reflect data and falls back to the only configured sidecar (anthropic, port 10001), bypassing the intended GitHub routing.

Changes

  • awf_config.go — When Claude engine uses model-provider: github and no explicit ANTHROPIC_BASE_URL is set, auto-configure the anthropic proxy target:

    "targets": { "anthropic": { "host": "api.githubcopilot.com", "authHeader": "Authorization" } }

    Switches from the default x-api-key header to Authorization to match Copilot API auth.

  • domains.go — Add api.githubcopilot.com to ClaudeDefaultDomains so the firewall permits the outbound connection.

  • compiler_validators.go — Emit an experimental feature warning when model-provider is overridden to a non-anthropic value on the Claude engine.


Generated by 👨‍🍳 PR Sous Chef · 26.2 AIC · ⌖ 8.22 AIC · ⊞ 7.5K ·
Comment /souschef to run again


Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 8.96 AIC · ⌖ 7.34 AIC · ⊞ 7.5K ·
Comment /souschef to run again


Run: https://github.com/github/gh-aw/actions/runs/29727086788

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 2.96 AIC · ⌖ 14.1 AIC · ⊞ 5.4K ·
Comment /souschef to run again


Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 9.44 AIC · ⌖ 7.25 AIC · ⊞ 6.9K ·
Comment /souschef to run again


Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 9.99 AIC · ⌖ 10.1 AIC · ⊞ 6.9K ·
Comment /souschef to run again


Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 16.7 AIC · ⌖ 10.4 AIC · ⊞ 7K ·
Comment /souschef to run again


Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 20.6 AIC · ⌖ 6.84 AIC · ⊞ 7K ·
Comment /souschef to run again

…t.com, add domain, mark experimental

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title Fix Claude engine configuration for GitHub provider Fix Claude engine routing for model-provider: github Jul 16, 2026
Copilot AI requested a review from pelikhan July 16, 2026 14:25
@pelikhan
pelikhan marked this pull request as ready for review July 16, 2026 14:28
Copilot AI review requested due to automatic review settings July 16, 2026 14:28
@github-actions

github-actions Bot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

PR Code Quality Reviewer completed the code quality review.

@github-actions

github-actions Bot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

@github-actions

github-actions Bot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #46013 does not have the 'implementation' label and has 0 new lines of code in business logic directories (threshold: 100).

@github-actions

github-actions Bot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Test Quality Sentinel completed test quality analysis.

@pelikhan

Copy link
Copy Markdown
Collaborator

/smoke-claude-on-copilot

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates gh-aw’s AWF (firewall) configuration generation so that when the Claude engine is configured with model-provider: github, the Anthropic proxy sidecar routes to GitHub Copilot’s inference endpoint (and the firewall allows the required outbound domain), preventing auth failures caused by sending Copilot tokens to api.anthropic.com.

Changes:

  • Auto-configure the AWF API proxy “anthropic” target to api.githubcopilot.com with Authorization header when Claude uses the GitHub provider (unless ANTHROPIC_BASE_URL is explicitly set).
  • Permit api.githubcopilot.com for Claude by adding it to default domain allowlists, and regenerate affected lock/golden artifacts.
  • Emit an experimental-feature warning when engine.model-provider is overridden to non-Anthropic on the Claude engine.
Show a summary per file
File Description
pkg/workflow/awf_config.go Adds conditional AWF target override for Claude+GitHub provider routing.
pkg/workflow/awf_config_test.go Adds tests covering the new Claude+GitHub provider AWF target behavior and precedence rules.
pkg/workflow/domains.go Adds api.githubcopilot.com to Claude default firewall domains.
pkg/workflow/compiler_validators.go Adds an experimental warning when Claude’s model-provider is set to a non-Anthropic value.
pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden Updates golden output to reflect the new allowed domain.
.github/workflows/typist.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists.
.github/workflows/skillet.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists (also updates header/manifest content).
.github/workflows/release.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists (also updates header/manifest content).
.github/workflows/github-mcp-tools-report.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists.
.github/workflows/example-workflow-analyzer.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists.
.github/workflows/detection-analysis-report.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists.
.github/workflows/daily-token-consumption-report.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists.
.github/workflows/daily-reliability-review.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists.
.github/workflows/daily-choice-test.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists.
.github/workflows/copilot-agent-analysis.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists.
.github/workflows/ci-doctor.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists.
.github/workflows/audit-workflows.lock.yml Regenerated lock to include api.githubcopilot.com in allowlists.
.github/workflows/agentic-auto-upgrade.yml Updates the scheduled cron time for the auto-upgrade workflow.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 39/69 changed files
  • Comments generated: 3
  • Review effort level: Low

Comment thread .github/workflows/agentic-auto-upgrade.yml
Comment thread .github/workflows/skillet.lock.yml Outdated
Comment thread .github/workflows/release.lock.yml
@github-actions

github-actions Bot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Smoke Claude on Copilot failed. Please review the logs for details.

@github-actions github-actions Bot mentioned this pull request Jul 16, 2026

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fix is well-targeted and correctly handles the Claude + model-provider: github routing bug.

Summary

  • awf_config.go: When the Claude engine uses model-provider: github and no explicit ANTHROPIC_BASE_URL is set, auto-configures the anthropic sidecar to route to api.githubcopilot.com with an Authorization header.
  • compiler_validators.go: Emits an experimental-feature warning for claude engine.model-provider when a non-Anthropic provider is used.
  • domains.go: Adds api.githubcopilot.com to ClaudeDefaultDomains so the firewall allowlist includes the endpoint.
  • Tests: Both new test cases cover the happy path and the explicit-override precedence correctly.
  • Lock/golden files: Regenerated consistently.

Minor observation

api.githubcopilot.com is added to ClaudeDefaultDomains, meaning it is allowed for all Claude workflows even when model-provider is anthropic. This is a safe over-allowance (GitHub-owned domain), but could be tightened in a follow-up by conditionally injecting the domain only when the GitHub provider is active.

No blocking issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · 42 AIC · ⌖ 6.79 AIC · ⊞ 5K

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skills-Based Review 🧠\n\nApplied /diagnosing-bugs and /tdd — one minor gap noted, no blocking issues.\n\n
\n📋 Summary\n\n#### Positive Highlights\n\n- ✅ Root cause properly addressed: the else if guard correctly short-circuits when an explicit ANTHROPIC_BASE_URL is set, preserving user overrides.\n- ✅ Two targeted regression tests added (awf_config_test.go): one for the happy path and one for the explicit-override precedence case.\n- ✅ api.githubcopilot.com added to ClaudeDefaultDomains so the firewall allows the new sidecar route without extra user config.\n- ✅ Experimental-feature warning emitted for non-default providers on the Claude engine — good discoverability.\n- ✅ Comment in awf_config.go explains why Authorization replaces x-api-key; that context is easy to lose.\n\n#### One Gap\n\nThe new experimental-feature warning in compiler_validators.go:326 has no test in compiler_validators_test.go. Every other flag in that slice is covered; this one should be too. See inline comment.\n\n

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · 49.7 AIC · ⌖ 4.48 AIC · ⊞ 6.7K
Comment /matt to run again

Comment thread pkg/workflow/compiler_validators.go
@github-actions

Copy link
Copy Markdown
Contributor

🧪 Test Quality Sentinel Report

Test Quality Score: 75/100 — Acceptable

Analyzed 2 new test(s): 2 design tests, 0 implementation tests, 0 violation(s).

📊 Metrics (2 tests)
Metric Value
Analyzed 2 (Go: 2, JS: 0)
✅ Design 2 (100%)
⚠️ Implementation 0 (0%)
Edge/error coverage 1 (50%)
Duplicate clusters 0
Inflation Yes (4:1 ratio)
🚨 Violations 0
Test File Classification Issues
claude github provider routes anthropic sidecar to api.githubcopilot.com awf_config_test.go design_test (behavioral contract) None — happy path verified
claude github provider does not override explicit ANTHROPIC_BASE_URL awf_config_test.go design_test (behavioral contract) None — precedence edge case verified

Analysis Summary

✅ Strengths:

  • Both tests validate critical behavioral contracts around engine routing and precedence
  • Proper build tag present (//go:build !integration)
  • All 5 assertions have descriptive failure messages
  • Test 2 covers important edge case: explicit env vars override defaults
  • No mocking violations or forbidden patterns

⚠️ Notes:

  • Test inflation ratio: 48 test lines / 12 production lines = 4:1 (exceeds 2:1 threshold)
  • While the ratio is high, it's justified by comprehensive coverage of a critical auth pathway
  • Both tests validate user-visible behavior (routing configuration)

Verdict

Tests passed review. 0% implementation tests (threshold: 30%). No guideline violations. Design coverage is strong for this critical configuration change.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🧪 Test quality analysis by Test Quality Sentinel · 15.9 AIC · ⌖ 10.3 AIC · ⊞ 6.8K ·
Comment /review to run again

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Test Quality Sentinel: 75/100. 0% implementation tests (threshold: 30%). All tests validate behavioral contracts with proper build tags and assertions.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Routing logic is correct and tests cover the key scenarios well. One minor observation below.

🔎 Code quality review by PR Code Quality Reviewer · 81.9 AIC · ⌖ 4.25 AIC · ⊞ 5.6K
Comment /review to run again

@pelikhan

Copy link
Copy Markdown
Collaborator

Copilot AI and others added 2 commits July 16, 2026 15:03
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
… not anthropic

When model-provider: github is set on the Claude engine, AWF should configure the
copilot provider (port 10002) to forward to api.githubcopilot.com. The driver already
sets ANTHROPIC_BASE_URL to http://host.docker.internal:10002 (copilot proxy port), and
the harness resolves the endpoint from /reflect — which now correctly maps
provider=github → copilot → http://api-proxy:10002 instead of falling back to
the only-configured anthropic proxy.

Previously the anthropic sidecar (port 10001) was configured to target
api.githubcopilot.com, but the harness was sending all traffic there via the
copilot proxy port anyway, making that configuration wrong. The fix ensures
the copilot proxy is marked as configured in AWF so /reflect correctly routes
the claude harness to the copilot endpoint.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, address the unresolved review feedback below, investigate the failed smoke run, and rerun checks once the branch is up to date.

Unresolved review threads:

Failed checks:

Generated by 👨🍳 PR Sous Chef
Comment /souschef to run again

Generated by 👨‍🍳 PR Sous Chef · 26.2 AIC · ⌖ 8.22 AIC · ⊞ 7.5K ·
Comment /souschef to run again

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown
Contributor

🔍 PR Triage — Run §29791496271

Field Value
Category bug
Risk 🔴 high
Score 77/100 (impact 40 + urgency 25 + quality 12)
Action fast_track

Rationale: Critical-path Claude engine routing — model-provider: github causes 401s on all Claude runs. 5-day carry-over. Needs immediate human review and merge.

Generated by 🔧 PR Triage Agent · 40.1 AIC · ⌖ 6.65 AIC · ⊞ 5.6K ·

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, address any unresolved review feedback, confirm the branch is current, and summarize the next concrete maintainer action once checks are ready.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 9.99 AIC · ⌖ 10.1 AIC · ⊞ 6.9K ·
Comment /souschef to run again

Copilot AI commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please run the pr-finisher skill, address any unresolved review feedback, confirm the branch is current, and summarize the next concrete maintainer action once checks are ready.

...

Branch is current at HEAD 36316b4 (0 commits behind main). All 4 review threads confirmed is_resolved: true per the GitHub API — the PR Sous Chef is reading stale data. Local validation passes (0 errors, 260 lock files in sync). A new copilot check run (29792040310) started at 01:02:46Z and is in progress.

Next action for maintainer: Wait for run 29792040310 to complete, then re-trigger /smoke-claude-on-copilot if that smoke check is required before merge.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill and post a concise maintainer-ready status update: confirm whether any unresolved review threads remain, whether CI needs a manual retrigger, and the exact next action to get this PR merged.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 16.7 AIC · ⌖ 10.4 AIC · ⊞ 7K ·
Comment /souschef to run again

Copilot AI commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please run the pr-finisher skill and post a concise maintainer-ready status update: confirm whether any unresolved review threads remain, whether CI needs a manual retrigger, and the exact ...

  • Reviews — All 4 threads resolved (is_resolved: true): r3596372593, r3596372641, r3596372676, r3596399223. The PR Sous Chef is reading stale data.
  • Checks (local)make agent-report-progress passes: 0 errors, 260 lock files in sync.
  • Checks (CI) — Copilot check run 29792040310 completed success at 01:14Z. A new run (29800448443) is in progress as of 04:09Z.
  • Mergeable — Branch is 0 commits behind main, HEAD 36316b4, working tree clean.

Next action: Merge when run 29800448443 completes (or trigger /smoke-claude-on-copilot if that smoke check is required by the merge policy).

@pelikhan

Copy link
Copy Markdown
Collaborator

/smoke-claude-on-copilot

@pelikhan

Copy link
Copy Markdown
Collaborator

/smoke-claude

@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

💫 TO BE CONTINUED... Smoke Claude failed! Our hero faces unexpected challenges...

@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Smoke Claude on Copilot failed. Please review the logs for details.

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, review any remaining unresolved feedback , rerun checks once the branch is up to date

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 20.6 AIC · ⌖ 6.84 AIC · ⊞ 7K ·
Comment /souschef to run again

Copilot AI and others added 2 commits July 21, 2026 05:37
…nfiguration

# Conflicts:
#	.github/workflows/api-consumption-report.lock.yml
#	.github/workflows/approach-validator.lock.yml
#	.github/workflows/audit-workflows.lock.yml
#	.github/workflows/avenger.lock.yml
#	.github/workflows/aw-failure-investigator.lock.yml
#	.github/workflows/blog-auditor.lock.yml
#	.github/workflows/ci-doctor.lock.yml
#	.github/workflows/claude-code-user-docs-review.lock.yml
#	.github/workflows/cli-version-checker.lock.yml
#	.github/workflows/cloclo.lock.yml
#	.github/workflows/copilot-agent-analysis.lock.yml
#	.github/workflows/copilot-session-insights.lock.yml
#	.github/workflows/daily-agentrx-trace-optimizer.lock.yml
#	.github/workflows/daily-astrostylelite-markdown-spellcheck.lock.yml
#	.github/workflows/daily-aw-cross-repo-compile-check.lock.yml
#	.github/workflows/daily-caveman-optimizer.lock.yml
#	.github/workflows/daily-choice-test.lock.yml
#	.github/workflows/daily-code-metrics.lock.yml
#	.github/workflows/daily-doc-healer.lock.yml
#	.github/workflows/daily-elixir-credo-snippet-audit.lock.yml
#	.github/workflows/daily-reliability-review.lock.yml
#	.github/workflows/daily-rendering-scripts-verifier.lock.yml
#	.github/workflows/daily-safe-output-optimizer.lock.yml
#	.github/workflows/daily-safe-outputs-conformance.lock.yml
#	.github/workflows/daily-safeoutputs-git-simulator.lock.yml
#	.github/workflows/daily-security-red-team.lock.yml
#	.github/workflows/daily-team-evolution-insights.lock.yml
#	.github/workflows/daily-token-consumption-report.lock.yml
#	.github/workflows/daily-vulnhunter-scan.lock.yml
#	.github/workflows/daily-yamllint-fixer.lock.yml
#	.github/workflows/deep-report.lock.yml
#	.github/workflows/deepsec-security-scan.lock.yml
#	.github/workflows/design-decision-gate.lock.yml
#	.github/workflows/detection-analysis-report.lock.yml
#	.github/workflows/developer-docs-consolidator.lock.yml
#	.github/workflows/eslint-refiner.lock.yml
#	.github/workflows/example-workflow-analyzer.lock.yml
#	.github/workflows/github-mcp-structural-analysis.lock.yml
#	.github/workflows/github-mcp-tools-report.lock.yml
#	.github/workflows/go-fan.lock.yml
#	.github/workflows/go-logger.lock.yml
#	.github/workflows/go-pattern-detector.lock.yml
#	.github/workflows/hourly-ci-cleaner.lock.yml
#	.github/workflows/instructions-janitor.lock.yml
#	.github/workflows/lockfile-stats.lock.yml
#	.github/workflows/portfolio-analyst.lock.yml
#	.github/workflows/prompt-clustering-analysis.lock.yml
#	.github/workflows/ruflo-backed-task.lock.yml
#	.github/workflows/safe-output-health.lock.yml
#	.github/workflows/scout.lock.yml
#	.github/workflows/semantic-function-refactor.lock.yml
#	.github/workflows/sergo.lock.yml
#	.github/workflows/smoke-agent-all-merged.lock.yml
#	.github/workflows/smoke-agent-all-none.lock.yml
#	.github/workflows/smoke-agent-public-approved.lock.yml
#	.github/workflows/smoke-agent-public-none.lock.yml
#	.github/workflows/smoke-agent-scoped-approved.lock.yml
#	.github/workflows/smoke-claude-on-copilot.lock.yml
#	.github/workflows/smoke-claude.lock.yml
#	.github/workflows/smoke-github-claude.lock.yml
#	.github/workflows/static-analysis-report.lock.yml
#	.github/workflows/step-name-alignment.lock.yml
#	.github/workflows/typist.lock.yml
#	pkg/workflow/testdata/TestWasmGolden_AllEngines/claude.golden

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
…LOT_GITHUB_TOKEN not github.token)

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please run the pr-finisher skill, review any remaining unresolved feedback , rerun checks once the branch is up to date

...

Branch merged with latest main (22 commits) and new fix pushed.

Root-cause of the /smoke-claude-on-copilot failure: when permissions.copilot-requests: write is set, llmProviderSecretExpression returns ${{ github.token }} (a server-to-server token). The Copilot engine's sidecar exchanges that token internally, but the Claude engine's anthropic sidecar forwards it as-is — and api.githubcopilot.com rejects server-to-server tokens with HTTP 400.

Fix (a6a17dd): claude_engine.go now always sets ANTHROPIC_API_KEY: ${{ secrets.COPILOT_GITHUB_TOKEN }} when the GitHub provider is in use, bypassing the hasCopilotRequestsWritePermission shortcut. smoke-claude-on-copilot.lock.yml regenerated accordingly. New test pins the behavior.

All 4 review threads remain resolved. Local validation: 0 errors, 260 lock files in sync.

Next action: Re-trigger /smoke-claude-on-copilot to confirm before merge.

@github-actions

Copy link
Copy Markdown
Contributor

PR Triage

Field Value
Category bug
Risk high
Score 80/100
Breakdown impact:40 · urgency:25 · quality:15
Action fast_track

Critical routing bug: Claude engine with model-provider:github was routing to api.anthropic.com causing 401s. Affects all GitHub-hosted Claude workflows. Large diff (30 files, +145/-145) but well-scoped to awf_config.go routing logic. Multiple APPROVED reviews from github-actions[bot]. High-priority human review needed.

Run §29809051050

Generated by 🔧 PR Triage Agent · 59.3 AIC · ⌖ 5.53 AIC · ⊞ 5.6K ·

@gh-aw-bot

Copy link
Copy Markdown
Collaborator

@copilot please run the pr-finisher skill, review any remaining unresolved feedback, and rerun checks once the branch is up to date.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • pi.dev

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "pi.dev"

See Network Configuration for more information.

Generated by 👨‍🍳 PR Sous Chef · 11.4 AIC · ⌖ 5.11 AIC · ⊞ 7K ·
Comment /souschef to run again

…nfiguration

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot AI commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

@copilot please run the pr-finisher skill, review any remaining unresolved feedback, and rerun checks once the branch is up to date.

...

Branch merged with latest main (5 commits). All 260 lock files regenerated via make recompile. Local validation passes — 0 errors, lock files in sync, tests pass.

All 4 review threads remain resolved (is_resolved: true).

Next action for maintainer: Re-trigger /smoke-claude-on-copilot to confirm before merge.

@pelikhan

Copy link
Copy Markdown
Collaborator

/smoke-claude-on-copilot

@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Smoke Claude on Copilot failed. Please review the logs for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants