Suggest `tools.github.mode: gh-proxy` when `api.github.com` is firewall-blocked by Copilot · Pull Request #28293 · github/gh-aw

Copilot · 2026-04-24T14:52:12Z

When the sandbox firewall blocks api.github.com, the alert in the agent issue/comment body should steer users toward tools.github.mode: gh-proxy rather than blindly adding api.github.com to network.allowed.

Changes

firewall_blocked_domains.cjs — generateBlockedDomainsSection now detects api.github.com in the blocked list and injects a tip before the network.allowed snippet:
```
💡 Tip: `api.github.com` is blocked because GitHub API access uses the built-in GitHub tools by default.
Instead of adding `api.github.com` to `network.allowed`, use `tools.github.mode: gh-proxy`...
```
Includes a YAML example and a link to the GitHub Tools docs.
firewall_blocked_domains.test.cjs — Three new cases: api.github.com alone, mixed with other blocked domains, and absent (no tip shown).

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/6e7ed1c2-999b-4c24-8057-c2f9d020badc Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-04-24T14:53:08Z

+  const hasGitHubApiBlocked = blockedDomains.includes("api.github.com");
+
+  if (hasGitHubApiBlocked) {
+    section += `> **💡 Tip:** \`api.github.com\` is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding \`api.github.com\` to \`network.allowed\`, use \`tools.github.mode: gh-proxy\` for direct pre-authenticated GitHub CLI access without requiring network access to \`api.github.com\`:\n`;


@copilot move text into markdown template in actions/setup/md and use render template function helper

Done in 2eb2067. Created actions/setup/md/firewall_blocked_domains.md with {key} placeholders for all dynamic content, and updated generateBlockedDomainsSection to use renderTemplateFromFile from messages_core.cjs. Tests pass the source-tree template path explicitly via an optional second parameter.

…erTemplateFromFile Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c419322e-1c45-4004-bc12-fa668a0f1736 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c419322e-1c45-4004-bc12-fa668a0f1736 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-04-24T15:20:47Z

+  // Build optional gh-proxy tip if api.github.com is blocked
+  const hasGitHubApiBlocked = blockedDomains.includes("api.github.com");
+  const ghProxyTip = hasGitHubApiBlocked
+    ? `> **💡 Tip:** \`api.github.com\` is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding \`api.github.com\` to \`network.allowed\`, use \`tools.github.mode: gh-proxy\` for direct pre-authenticated GitHub CLI access without requiring network access to \`api.github.com\`:\n` +


@copilot move this tip to template file as well

Done in 4e3a6c9. The tip text now lives in firewall_blocked_domains.md inside a {{#if {has_github_api_blocked}}}...{{/if}} block. The JS passes has_github_api_blocked: "true"/"false" to renderTemplateFromFile, then chains renderMarkdownTemplate for the conditional pass (isTruthy("false") === false per the template engine's explicit check).

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/211e7bfd-9bea-49c0-bc8e-66c11a68d91a Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-04-24T15:45:40Z

🧪 Test Quality Sentinel Report

Test Quality Score: 100/100

✅ Excellent test quality

Metric	Value
New/modified tests analyzed	5
✅ Design tests (behavioral contracts)	5 (100%)
⚠️ Implementation tests (low value)	0 (0%)
Tests with error/edge cases	5 (100%)
Duplicate test clusters	0
Test inflation detected	No (ratio: 1.36×)
🚨 Coding-guideline violations	None

Test Classification Details

Test	File	Classification	Issues Detected
`should use destIpPort as fallback when domain is placeholder`	`firewall_blocked_domains.test.cjs`	✅ Design	None
`should filter out internal Squid error entries (::1 client, -:- destination)`	`firewall_blocked_domains.test.cjs`	✅ Design	None
`should suggest gh-proxy mode when api.github.com is blocked`	`firewall_blocked_domains.test.cjs`	✅ Design	None
`should suggest gh-proxy mode when api.github.com is among other blocked domains`	`firewall_blocked_domains.test.cjs`	✅ Design	None
`should not suggest gh-proxy mode when api.github.com is not blocked`	`firewall_blocked_domains.test.cjs`	✅ Design	None

Flagged Tests — Requires Review

None. All new tests are high-quality behavioral tests.

Language Support

Tests analyzed:

🟨 JavaScript (*.test.cjs): 5 tests (vitest)

Verdict

✅ Check passed. 0% of new tests are implementation tests (threshold: 30%).

All five new tests assert on observable return values and cover important behavioral contracts: iptables-dropped traffic fallback, Squid internal error filtering, gh-proxy suggestion when api.github.com is blocked (positive, combined, and negative cases). Each test also exercises error/edge paths (null/empty inputs, non-existent directories, placeholder domain handling).

📖 Understanding Test Classifications

Design Tests (High Value) verify what the system does:

Assert on observable outputs, return values, or state changes
Cover error paths and boundary conditions
Would catch a behavioral regression if deleted
Remain valid even after internal refactoring

Implementation Tests (Low Value) verify how the system does it:

Assert on internal function calls (mocking internals)
Only test the happy path with typical inputs
Break during legitimate refactoring even when behavior is correct
Give false assurance: they pass even when the system is wrong

Goal: Shift toward tests that describe the system's behavioral contract — the promises it makes to its users and collaborators.

References: §24898168106

🧪 Test quality analysis by Test Quality Sentinel · ● 729.8K · ◷

github-actions

✅ Test Quality Sentinel: 100/100. Test quality is excellent — 0% of new tests are implementation tests (threshold: 30%). All 5 new tests verify behavioral contracts with real assertions on observable outputs and solid edge-case coverage.

Copilot

Pull request overview

Updates the firewall-blocked-domains warning to give targeted guidance when api.github.com is blocked, steering users toward GitHub Tools gh-proxy mode instead of adding the GitHub API domain to network.allowed.

Changes:

Adds a conditional “gh-proxy” tip when api.github.com appears in the blocked domain list.
Refactors generateBlockedDomainsSection to render from a Markdown template with placeholder substitution + conditional processing.
Extends test coverage with cases for api.github.com present/absent.

Show a summary per file

File	Description
actions/setup/md/firewall_blocked_domains.md	Adds templated warning content and conditional `gh-proxy` tip when GitHub API is blocked.
actions/setup/js/firewall_blocked_domains.cjs	Switches blocked-domain section generation to template rendering and adds `api.github.com` detection.
actions/setup/js/firewall_blocked_domains.test.cjs	Adds/updates tests to validate the new tip behavior and template-based rendering.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 4

Copilot · 2026-04-24T15:46:15Z

+>
+> The following {domain_word} {verb} blocked by the firewall during workflow execution:
+>
+{domain_list}>


The {domain_list} placeholder line ends with an extra > ({domain_list}>), which will render an unintended standalone blockquote marker after the bullet list. Remove the trailing > so the rendered warning block doesn’t include a spurious > line.

Suggested change

{domain_list}>

{domain_list}

Copilot · 2026-04-24T15:46:16Z

+> network:
+>   allowed:
+>     - defaults
+{yaml_network_list}> ```


The YAML list placeholder and the closing code fence are currently on the same template line ({yaml_network_list}> ````). This is fragile and can produce malformed Markdown depending on whether the placeholder expansion ends with a newline. Put {yaml_network_list}on its own line and keep the closing> ``` on the next line (and remove any stray>` after the placeholder) so the fenced block is always well-formed.

Suggested change

{yaml_network_list}> ```

{yaml_network_list}

> ```

Copilot · 2026-04-24T15:46:16Z

 * Generates HTML details/summary section for blocked domains wrapped in a GitHub warning alert
- * @param {string[]} blockedDomains - Array of blocked domain names
+ * @param {string[]} blockedDomains - Array of blocked domain names (expected to be pre-sanitized via getBlockedDomains)
+ * @param {string} [templatePath] - Optional path to template file (defaults to RUNNER_TEMP/gh-aw/prompts/firewall_blocked_domains.md)


The JSDoc still says this function generates an “HTML details/summary section”, but the implementation now renders a Markdown warning alert from a template. Update the description to match the actual output to avoid confusing future maintainers.

See below for a potential fix:

* Renders a Markdown GitHub warning alert for blocked domains from a template * @param {string[]} blockedDomains - Array of blocked domain names (expected to be pre-sanitized via getBlockedDomains) * @param {string} [templatePath] - Optional path to template file (defaults to RUNNER_TEMP/gh-aw/prompts/firewall_blocked_domains.md) * @returns {string} Rendered Markdown warning alert, or empty string if no blocked domains

Copilot · 2026-04-24T15:46:16Z

+  // Resolve template path: explicit > RUNNER_TEMP (production) > source tree (local dev/test)
+  let resolvedTemplatePath = templatePath;
+  if (!resolvedTemplatePath) {
+    resolvedTemplatePath = process.env.RUNNER_TEMP ? `${process.env.RUNNER_TEMP}/gh-aw/prompts/firewall_blocked_domains.md` : path.join(__dirname, "../md/firewall_blocked_domains.md");


Template path resolution here doesn’t honor the existing GH_AW_PROMPTS_DIR override that other prompt-rendering code uses (e.g., actions/setup/js/comment_memory.cjs:24 and actions/setup/js/gateway_difc_filtered.cjs:128). To keep behavior consistent (and make testing/overrides work uniformly), consider resolving promptsDir via process.env.GH_AW_PROMPTS_DIR || ${process.env.RUNNER_TEMP}/gh-aw/prompts`` when templatePath isn’t provided.

Suggested change

// Resolve template path: explicit > RUNNER_TEMP (production) > source tree (local dev/test)

let resolvedTemplatePath = templatePath;

if (!resolvedTemplatePath) {

resolvedTemplatePath = process.env.RUNNER_TEMP ? `${process.env.RUNNER_TEMP}/gh-aw/prompts/firewall_blocked_domains.md` : path.join(__dirname, "../md/firewall_blocked_domains.md");

// Resolve template path: explicit > GH_AW_PROMPTS_DIR override > RUNNER_TEMP (production) > source tree (local dev/test)

let resolvedTemplatePath = templatePath;

if (!resolvedTemplatePath) {

const promptsDir =

process.env.GH_AW_PROMPTS_DIR ||

(process.env.RUNNER_TEMP && `${process.env.RUNNER_TEMP}/gh-aw/prompts`);

resolvedTemplatePath = promptsDir

? path.join(promptsDir, "firewall_blocked_domains.md")

: path.join(__dirname, "../md/firewall_blocked_domains.md");

feat: suggest gh-proxy mode when api.github.com is blocked by firewall

55d16d2

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/6e7ed1c2-999b-4c24-8057-c2f9d020badc Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Apr 24, 2026

Copilot created this pull request from a session on behalf of pelikhan April 24, 2026 14:52 View session

pelikhan reviewed Apr 24, 2026

View reviewed changes

Copilot started work on behalf of pelikhan April 24, 2026 14:59 View session

Copilot AI and others added 2 commits April 24, 2026 15:11

refactor: move firewall blocked domains text to md template, use rend…

e43828b

…erTemplateFromFile Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c419322e-1c45-4004-bc12-fa668a0f1736 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: address code review feedback on template and path resolution

2eb2067

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/c419322e-1c45-4004-bc12-fa668a0f1736 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan April 24, 2026 15:15

Copilot AI requested a review from pelikhan April 24, 2026 15:15

pelikhan reviewed Apr 24, 2026

View reviewed changes

Copilot started work on behalf of pelikhan April 24, 2026 15:21 View session

Copilot AI and others added 2 commits April 24, 2026 15:27

refactor: move gh-proxy tip text into template using {{#if}} conditional

4e3a6c9

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/211e7bfd-9bea-49c0-bc8e-66c11a68d91a Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

docs: clarify isTruthy string evaluation in comment

d791deb

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/211e7bfd-9bea-49c0-bc8e-66c11a68d91a Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan April 24, 2026 15:30

Copilot AI requested a review from pelikhan April 24, 2026 15:30

pelikhan marked this pull request as ready for review April 24, 2026 15:40

Copilot AI review requested due to automatic review settings April 24, 2026 15:41

pelikhan merged commit 94f9b68 into main Apr 24, 2026
15 of 19 checks passed

pelikhan deleted the copilot/update-firewall-alert-js-code branch April 24, 2026 15:41

Copilot started reviewing on behalf of pelikhan April 24, 2026 15:41 View session

github-actions Bot mentioned this pull request Apr 24, 2026

[aw] No-Op Runs #28177

Open

github-actions Bot approved these changes Apr 24, 2026

View reviewed changes

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Suggest `tools.github.mode: gh-proxy` when `api.github.com` is firewall-blocked#28293

Suggest `tools.github.mode: gh-proxy` when `api.github.com` is firewall-blocked#28293
pelikhan merged 5 commits intomainfrom
copilot/update-firewall-alert-js-code

Copilot AI commented Apr 24, 2026

Uh oh!

pelikhan Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

pelikhan Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Uh oh!

github-actions Bot commented Apr 24, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 24, 2026

Changes

Uh oh!

pelikhan Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Apr 24, 2026

🧪 Test Quality Sentinel Report

Test Quality Score: 100/100

Test Classification Details

Flagged Tests — Requires Review

Language Support

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants