refactor: extract validateAuthHeaderEnv and isValidHeaderName helpers by lpcox · Pull Request #4783 · github/gh-aw-firewall

lpcox · 2026-06-11T18:08:25Z

Summary

Centralizes the repeated HTTP header name validation pattern into two helpers in proxy-utils.js:

validateAuthHeaderEnv(envVarName, rawValue, defaultHeader) — reads/trims/validates an env var as an HTTP header name, throwing with a descriptive error on failure. Replaces the throw-on-invalid IIFEs in anthropic.js and openai.js.
isValidHeaderName(name) — boolean predicate wrapping http.validateHeaderName(). Replaces the try/catch in copilot-byok.js's header loop.

Centralizes HTTP header name validation into proxy-utils.js: - validateAuthHeaderEnv(): throw-on-invalid pattern (anthropic, openai) - isValidHeaderName(): boolean predicate (copilot-byok loop) Fixes #4709 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-06-11T18:10:04Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	96.54%	96.58%	📈 +0.04%
Statements	96.46%	96.50%	📈 +0.04%
Functions	98.78%	98.78%	➡️ +0.00%
Branches	91.14%	91.18%	📈 +0.04%

📁 Per-file Coverage Changes (1 files)

File	Lines (Before → After)	Statements (Before → After)
`src/config-writer.ts`	90.2% → 91.4% (+1.23%)	90.2% → 91.4% (+1.23%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

This PR refactors repeated HTTP header-name validation logic used by api-proxy provider adapters into shared helpers in containers/api-proxy/proxy-utils.js, addressing #4709 and reducing duplicated validation/try-catch patterns across providers.

Changes:

Added validateAuthHeaderEnv(envVarName, rawValue, defaultHeader) to centralize trimming + header-name validation + consistent error messages for custom auth-header env vars.
Added isValidHeaderName(name) as a boolean wrapper around Node’s http.validateHeaderName() to simplify skip-on-invalid header handling.
Updated Anthropic/OpenAI adapters and the Copilot BYOK extra-header parser to use the new helpers instead of local duplicated logic.

Show a summary per file

File	Description
containers/api-proxy/proxy-utils.js	Introduces shared header-name validation helpers and exports them for adapter use.
containers/api-proxy/providers/openai.js	Replaces inline env-var header validation IIFE with `validateAuthHeaderEnv`.
containers/api-proxy/providers/anthropic.js	Replaces inline auth-header env-var validation with `validateAuthHeaderEnv` (defaulting to `x-api-key`).
containers/api-proxy/providers/copilot-byok.js	Replaces per-header try/catch validation with `isValidHeaderName` for skip-on-invalid behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 4/4 changed files
Comments generated: 0

github-actions · 2026-06-11T18:14:01Z

Smoke Test: Copilot PAT Auth — PR #4783 by @lpcox

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ HTTP 200
File write/read	⚠️ template vars unsubstituted

PR: refactor: extract validateAuthHeaderEnv and isValidHeaderName helpers
Auth mode: PAT (COPILOT_GITHUB_TOKEN)
Overall: PASS (2/2 live tests passed; file test skipped — pre-step data not injected)

🔑 PAT report filed by Smoke Copilot PAT

github-actions · 2026-06-11T18:14:47Z

🔍 Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
S1: Module Loading	✅	`otel.js` loads successfully; exports: `startRequestSpan`, `setTokenAttributes`, `setBudgetAttributes`, `endSpan`, `endSpanError`, `shutdown`, `isEnabled` + test helpers
S2: Test Suite	✅	39/39 tests passed in `otel.test.js`
S3: Env Var Forwarding	✅	`api-proxy-service-config.ts` forwards `OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_HEADERS`, `GITHUB_AW_OTEL_TRACE_ID`, `GITHUB_AW_OTEL_PARENT_SPAN_ID`, `OTEL_SERVICE_NAME`
S4: Token Tracker Integration	✅	`onUsage` callback present in `token-tracker-http.js`; invoked after normalized usage extracted
S5: OTEL Diagnostics	⏳	Post-step pending (workflow still in progress)

All completed scenarios pass. S5 will populate once the workflow finishes.

📡 OTel tracing validated by Smoke OTel Tracing

github-actions · 2026-06-11T18:15:05Z

perf(doc-maintainer): reduce per-run token usage
perf(test-coverage-reporter): reduce token usage ~7-10% per run
✅ GitHub title check
✅ File write/read
✅ Build
✅ Discussion comment
Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

github-actions · 2026-06-11T18:15:26Z

🔥 Smoke Test Results

PR: refactor: extract validateAuthHeaderEnv and isValidHeaderName helpers
Author: @lpcox

Test	Result
GitHub MCP connectivity	✅
GitHub.com HTTP (200)	✅
File write/read	✅

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot

github-actions · 2026-06-11T18:15:52Z

🔍 Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	`Python 3.12.13`	`Python 3.12.3`	❌ NO
Node.js	`v24.16.0`	`v22.22.3`	❌ NO
Go	`go1.22.12`	`go1.22.12`	✅ YES

Overall: ❌ FAILED — Python and Node.js versions differ between host and chroot environments.

Tested by Smoke Chroot

github-actions · 2026-06-11T18:16:35Z

refactor: extract validateAuthHeaderEnv and isValidHeaderName helpers
refactor: extract createCounterGuard factory for guard modules

GitHub MCP connectivity: ✅
GitHub.com connectivity: ✅
File Write/Read Test: ❌
BYOK Inference Test: ✅

Running in direct BYOK mode (AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

Overall: FAIL

cc @lpcox

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

github-actions · 2026-06-11T18:17:26Z

refactor: extract validateAuthHeaderEnv and isValidHeaderName helpers

GitHub MCP connectivity: ✅
GitHub.com connectivity: ✅
File write/read: ✅
BYOK inference: ✅
Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw)
Overall: PASS
@lpcox

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

github-actions · 2026-06-11T18:22:49Z

GitHub API: ✅ PASS
GitHub check: ✅ PASS
File verify: ✅ PASS

Total: PASS

💥 [THE END] — Illustrated by Smoke Claude

github-actions · 2026-06-11T18:28:27Z

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

Test Results:

✅ MCP connectivity: 2 recent merged PRs fetched
✅ GitHub.com connectivity: HTTP 200
✅ File write/read: Working
✅ BYOK inference: Active (responding via api-proxy → api.githubcopilot.com)

Mode: Direct BYOK (COPILOT_PROVIDER_API_KEY via api-proxy sidecar)
PR: #4783 — refactor: extract validateAuthHeaderEnv and isValidHeaderName helpers
Author: @lpcox | Assignees: @lpcox, @Copilot

🔑 BYOK report filed by Smoke Copilot BYOK

github-actions · 2026-06-11T18:47:34Z

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ timeout (no response from `host.docker.internal:6379`)
PostgreSQL pg_isready	❌ `no response`
PostgreSQL SELECT 1	❌ timeout (no response from `host.docker.internal:5432`)

Overall: FAIL — host.docker.internal is unreachable from this runner environment. Service containers are not accessible.

🔌 Service connectivity validated by Smoke Services

Copilot AI review requested due to automatic review settings June 11, 2026 18:08

Copilot started reviewing on behalf of lpcox June 11, 2026 18:09 View session

lpcox temporarily deployed to aoai-model June 11, 2026 18:10 — with GitHub Actions Inactive

Copilot AI reviewed Jun 11, 2026

View reviewed changes

github-actions Bot added the smoke-copilot-pat label Jun 11, 2026

github-actions Bot mentioned this pull request Jun 11, 2026

[aw] Contribution Check failed #4772

Closed

github-actions Bot added the smoke-codex label Jun 11, 2026

github-actions Bot added the smoke-copilot label Jun 11, 2026

lpcox temporarily deployed to aoai-model June 11, 2026 18:16 — with GitHub Actions Inactive

github-actions Bot added the smoke-copilot-byok-aoai-apikey label Jun 11, 2026

github-actions Bot mentioned this pull request Jun 11, 2026

[aw] No-Op Runs #4045

Closed

github-actions Bot added smoke-claude smoke-copilot-byok labels Jun 11, 2026

lpcox merged commit 4cc9de2 into main Jun 11, 2026
83 of 86 checks passed

lpcox deleted the refactor/dedup-validate-custom-headers branch June 11, 2026 18:38

github-actions Bot mentioned this pull request Jun 11, 2026

fix: skip symlink assertion for pre-existing path segments #4786

Merged

github-actions Bot mentioned this pull request Jun 11, 2026

refactor: extract createCounterGuard factory for guard modules #4784

Merged

Uh oh!

Conversation

lpcox commented Jun 11, 2026

Summary

Uh oh!

github-actions Bot commented Jun 11, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

🔍 Smoke Test: API Proxy OpenTelemetry Tracing

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

🔥 Smoke Test Results

Uh oh!

github-actions Bot commented Jun 11, 2026

🔍 Chroot Version Comparison Results

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Smoke Test: Copilot BYOK (Direct) Mode ✅ PASS

Uh oh!

Uh oh!

github-actions Bot commented Jun 11, 2026

Smoke Test: GitHub Actions Services Connectivity

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants