Skip to content

fix: strip URL scheme from expression-based API targets at runtime#25250

Closed
Copilot wants to merge 2 commits intomainfrom
copilot/fix-duplicate-https-scheme
Closed

fix: strip URL scheme from expression-based API targets at runtime#25250
Copilot wants to merge 2 commits intomainfrom
copilot/fix-duplicate-https-scheme

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Apr 8, 2026

When ANTHROPIC_BASE_URL/OPENAI_BASE_URL/GITHUB_COPILOT_BASE_URL is a GHA expression (${{ vars.ANTHROPIC_BASE_URL }}), extractAPITargetHost can't detect :// at compile time and passes the expression verbatim as --anthropic-api-target. At runtime the expression resolves to a full URL; the API proxy receives it where it expects a bare hostname and constructs https://https://my-gateway.example.com → 403.

Hardcoded URLs are unaffected — extractAPITargetHost strips the scheme correctly at compile time.

Changes

  • isEnvVarExpression() — detects when an engine.env var is a GHA expression
  • buildExpressionAPITargetArgs() — for each expression-based API target env var, returns:
    • a shell preamble that strips https:///http:// and the path suffix via Bash parameter expansion
    • an expandable AWF arg referencing the resulting shell variable
  • BuildAWFArgs() — skips expression-based targets from the static args list
  • BuildAWFCommand() — calls buildExpressionAPITargetArgs() and splices the preamble before the awf invocation; unified the PathSetup + API-target preamble into a single code path

Generated shell for ANTHROPIC_BASE_URL: ${{ vars.ANTHROPIC_BASE_URL }}:

set -o pipefail
_GH_AW_ANTHROPIC_TARGET='${{ vars.ANTHROPIC_BASE_URL }}'; \
  _GH_AW_ANTHROPIC_TARGET="${_GH_AW_ANTHROPIC_TARGET#https://}"; \
  _GH_AW_ANTHROPIC_TARGET="${_GH_AW_ANTHROPIC_TARGET#http://}"; \
  _GH_AW_ANTHROPIC_TARGET="${_GH_AW_ANTHROPIC_TARGET%%/*}"
# shellcheck disable=SC1003
sudo -E awf ... --anthropic-api-target "${_GH_AW_ANTHROPIC_TARGET}" \
  -- ...

GitHub resolves the expression before the shell runs, so _GH_AW_ANTHROPIC_TARGET receives https://my-gateway.example.com/path and is stripped to my-gateway.example.com before AWF sees it.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

  • https://api.github.com/graphql
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -trimpath /bin/sh git rev-�� --show-toplevel /bin/sh /usr/bin/git runs/20260408-06git -dwarf=false t git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw remote.origin.ur--norc /usr/bin/gh git rev-�� --show-toplevel gh /usr/bin/git download 12345 /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw 64/pkg/tool/linu--norc /usr/bin/infocmp--noprofile node /opt�� install --package-lock-only /usr/bin/git xterm-color 64/pkg/tool/linu-V=full /usr/bin/git git (http block)
  • https://api.github.com/orgs/test-owner/actions/secrets
    • Triggering command: /usr/bin/gh gh api /orgs/test-owner/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json d.go 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
    • Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/compile /usr/bin/git _.a GO111MODULE /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel go /usr/bin/git e=false 5Hh4AuvTv x_amd64/link git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v3
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha t go /usr/bin/git -json GO111MODULE 64/bin/go git rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE x_amd64/asm git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v5
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha 399004/b094/_pkg_.a om/goccy/go-yaml@v1.19.2/contextmain x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet -c Onlymin-integrity_with_explicit_go1.25.8 nTLC/e3WDbj-6Hz_OhJqGnTLC ache/go/1.25.8/x64/pkg/tool/linu-nolocalimports GOSUMDB b/gh-aw/pkg/consrev-parse 64/bin/go ache/go/1.25.8/x64/pkg/tool/linu/tmp/go-build3094883471/b455/_testmain.go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linu-buildtags /usr/bin/git rtcfg GO111MODULE .cfg git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linuorigin /usr/bin/git ExpressionCompilgit O_e3/jNiaaPEe3F5rev-parse 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel git /usr/bin/git poJ_/sX9FX53sm1Ogit l /opt/hostedtoolc--show-toplevel git rev-�� --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git /tmp/go-build309git 4883471/b455/_terev-parse /usr/bin/git git (http block)
  • https://api.github.com/repos/actions/checkout/git/ref/tags/v6
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linu-trimpath /usr/bin/gh _.a @v1.19.2/lexer/lrev-parse 64/pkg/tool/linu--show-toplevel gh run download 1 /usr/bin/git test-logs/run-1 V0s1bKvb3 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --git-dir 64/pkg/tool/linux_amd64/asm /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel /usr/bin/git remo�� -v 64/pkg/tool/linux_amd64/compile /usr/bin/git md GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha tags/v4 git /usr/bin/git ErrorFormatting1git config /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel go /tmp/go-build309--show-toplevel git (http block)
  • https://api.github.com/repos/actions/github-script/git/ref/tags/v8
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha go1.25.8 -c=4 -nolocalimports -importcfg /tmp/go-build490399004/b249/importcfg -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/fileutil/fileutil.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha json' --ignore-p-p GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env th .prettierigno-s GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 1 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env th .prettierignogo1.25.8 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel 64/pkg/tool/linuconfig /usr/bin/gh _.a @v1.19.2/parser/rev-parse 64/pkg/tool/linu--show-toplevel gh run download 4 /usr/bin/git test-logs/run-4 AmvwaUv3n 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha GOMODCACHE 64/pkg/tool/linux_amd64/compile /usr/bin/gh _.a @v1.19.2/internarev-parse 64/pkg/tool/linu--show-toplevel gh run download 3 /usr/bin/git test-logs/run-3 sYYP-7R33 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
    • Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha --show-toplevel /tmp/go-build490399004/b132/importcfg e1ad6f180b56527fea11c6cfb1b71a15d2e7b3a38dc78c2b-d -json GO111MODULE 64/bin/go git rev-�� ithub-script/git/ref/tags/v8 go 64/pkg/tool/linux_amd64/vet -json GO111MODULE sh 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha --show-toplevel /opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/link $name) { hasDiscussionsEnabled } } /tmp/go-build309bash -importcfg /usr/bin/git git rev-�� --show-toplevel git /usr/bin/git --show-toplevel -extld=gcc /usr/bin/git git (http block)
    • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha --show-toplevel git /usr/bin/git --show-toplevel 64/pkg/tool/linu--norc /usr/bin/git git rev-�� --show-toplevel git /usr/bin/gh --show-toplevel 64/pkg/tool/linu-C /usr/bin/git gh (http block)
  • https://api.github.com/repos/github/gh-aw
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0.1.2
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0.1.2 --jq .object.sha --show-toplevel 64/pkg/tool/linuremote.origin.url /usr/bin/gh _.a GO111MODULE 64/pkg/tool/linu--show-toplevel gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts /usr/bin/git .artifacts[].namgit ri/jsonschema/v6rev-parse 64/pkg/tool/linu--show-toplevel git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.0.0 --jq .object.sha -stringintconv -tests 1/x64/bin/node -json GO111MODULE 64/bin/go 1/x64/bin/node rev-�� --show-toplevel go /usr/bin/git -json GO111MODULE 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v1.2.3 --jq .object.sha --symref l 1/x64/bin/node -json GO111MODULE 64/bin/go 1/x64/bin/node -C /tmp/TestGuardPolicyMinIntegrityOnlymin-integrity_with_repos=public_24689288/001 remote /usr/bin/git yphen3231498900/git yphen3231498900/rev-parse 64/bin/go git (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/1/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE ic_wasm.o 64/src/internal//home/REDACTED/work/gh-aw/gh-aw/.github/workflows/ai-moderator.md 64/pkg/tool/linux_amd64/compile env 3578905509 deRMpwyMD ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 V0s1bKvb3 64/pkg/tool/linu-importcfg GOINSECURE (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12345/artifacts --jq .artifacts[].name til.go 64/pkg/tool/linux_amd64/compile GOINSECURE o 64/src/internal//home/REDACTED/work/gh-aw/gh-aw/.github/workflows/agentic-observability-kit.md 64/pkg/tool/linux_amd64/compile k/gh�� _.a 34i--fWCy ache/go/1.25.8/x64/pkg/tool/linu-nolocalimports GOINSECURE til erignore ache/go/1.25.8/xorigin (http block)
    • Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 0/message/catalog/catalog.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD bis 64/pkg/tool/linux_amd64/compile k/gh�� _.a PcfUGjA_S ache/go/1.25.8/x64/pkg/tool/linu-lang=go1.25 GOINSECURE erutil ode-gyp-bin/node--get ache/go/1.25.8/xremote.origin.url (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/12346/artifacts --jq .artifacts[].name l.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD bis 64/pkg/tool/linux_amd64/compile 64/s�� _.a bbyq8rTOi x_amd64/compile GOINSECURE GOMOD erignore x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 0/internal/format/format.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD bis 64/pkg/tool/linutest@example.com k/gh�� _.a GO111MODULE x_amd64/link GOINSECURE g 64/src/reflect/a--get x_amd64/link (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/2/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD bis 64/pkg/tool/linutest@example.com env 3578905509 QuPWq4ACQ ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 S1XHWmzm6 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD ode-gyp-bin/sh 64/pkg/tool/linuTest User env XMdlm1J_w GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuconfig (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/3/artifacts --jq .artifacts[].name ri/jsonschema/v6@v6.0.2/kind/kind.go 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile ache�� _.a YfB4YDUdE x_amd64/link GOINSECURE chema/v6 GOMODCACHE x_amd64/link (http block)
    • Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 sYYP-7R33 64/pkg/tool/linux_amd64/vet GOINSECURE l/errors GOMODCACHE 64/pkg/tool/linux_amd64/vet env SaeZgGgAk GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linurev-parse (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/4/artifacts --jq .artifacts[].name CY7t-lTSd 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env _.a Bzwz7Kv-X ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 AmvwaUv3n 64/pkg/tool/linux_amd64/cgo GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com env rtcfg uKJh7UXOD ache/go/1.25.8/x64/pkg/tool/linu-test.short=true GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuremote (http block)
  • https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
    • Triggering command: /usr/bin/gh gh api --paginate repos/{owner}/{repo}/actions/runs/5/artifacts --jq .artifacts[].name GO111MODULE 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD bis 64/pkg/tool/linuTest User ache�� 3578905509 64jHUho52 ck GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm (http block)
    • Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 kVjpTbR-V 64/pkg/tool/linux_amd64/asm GOINSECURE l/format GOMODCACHE 64/pkg/tool/linux_amd64/asm env t5smDhwOz GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE sh GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile env b/workflows B-Au8vNkW 64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.47.4
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.47.4 --jq .object.sha --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 726960308/.githugit vNkW/MmwpPo_3e3trev-parse ache/go/1.25.8/x--show-toplevel git rev-�� --show-toplevel ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile /usr/bin/git 4883471/b415/_pkgit sh eutil.test git (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha _.a m0O72i2Jk 64/pkg/tool/linux_amd64/compile GOINSECURE 64 GOMODCACHE 64/pkg/tool/linuTest User env g_.a GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE util GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha th .prettierignogo1.25.8 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile 2507�� -json exer.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha th .prettierignogo1.25.8 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json color.go x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE 1_nTxK_/fOR2rAqds3b5wmWKGRJt er_b�� -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
    • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha -json GO111MODULE x_amd64/asm GOINSECURE GOMOD GOMODCACHE x_amd64/asm env -json GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
  • https://api.github.com/repos/githubnext/agentics/git/ref/tags/-
    • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/- --jq .object.sha . git (http block)
  • https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
    • Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha l.go l_test.go ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile r code style"; tgit go-sdk/internal/rev-parse GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linuTest User env tnsdGrDwG GO111MODULE ache/go/1.25.8/x64/pkg/tool/linux_amd64/compile GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linurev-parse (http block)
  • https://api.github.com/repos/nonexistent/repo/actions/runs/12345
    • Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE essage 64/src/runtime/a--show-toplevel 64/pkg/tool/linux_amd64/vet env -json ke8fejfLv ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm GOINSECURE GOMOD GOMODCACHE ache/go/1.25.8/x64/pkg/tool/linux_amd64/asm (http block)
  • https://api.github.com/repos/owner/repo/actions/workflows
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json go 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
    • Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE odules/npm/node_-lang=go1.23 GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/owner/repo/contents/file.md
    • Triggering command: /tmp/go-build3094883471/b397/cli.test /tmp/go-build3094883471/b397/cli.test -test.testlogfile=/tmp/go-build3094883471/b397/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true -importcfg /tmp/go-build490399004/b215/importcfg -pack /home/REDACTED/go/pkg/mod/github.com/segmentio/asm@v1.1.3/base64/base64.go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
  • https://api.github.com/repos/test-owner/test-repo/actions/secrets
    • Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)

If you need me to access, download, or install something from one of these locations, you can either:

When ANTHROPIC_BASE_URL, OPENAI_BASE_URL, or GITHUB_COPILOT_BASE_URL is
set to a GitHub Actions expression (e.g., ${{ vars.ANTHROPIC_BASE_URL }}),
the compiler cannot extract the hostname at compile time. Previously, the
raw expression was passed directly as --anthropic-api-target, which at
runtime resolved to a full URL like https://my-gateway.example.com/path.
The AWF API proxy received this full URL but expected a bare hostname,
causing it to prepend https:// again, resulting in a double-scheme URL
(https://https://my-gateway.example.com) and ERR_ACCESS_DENIED (403).

Fix: detect expression-based values in BuildAWFArgs and exclude them from
the static args list. BuildAWFCommand now calls buildExpressionAPITargetArgs
which generates a shell preamble that strips the URL scheme and path at
runtime using parameter expansion, then passes the resulting bare hostname
via an expandable arg reference.

Hardcoded URLs (the common case) continue to work exactly as before via
extractAPITargetHost at compile time.

Fixes: AWF API proxy doubles https:// scheme in --anthropic-api-target URL

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f3c6319a-0081-4770-a657-5c2dd2d83a74

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix duplication of https:// scheme in ANTHROPIC_BASE_URL fix: strip URL scheme from expression-based API targets at runtime Apr 8, 2026
Copilot AI requested a review from pelikhan April 8, 2026 06:49
@pelikhan pelikhan closed this Apr 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

AWF API proxy doubles https:// scheme in --anthropic-api-target URL

2 participants