Compiler: auto-add GHES domains to --allow-domains when engine.api-target is set

[Copilot]

When engine.api-target is set for a GHES instance, the compiler correctly passed --copilot-api-target to AWF but never added the GHES hostnames to the firewall allow-lists — meaning every recompile silently broke GHES workflows by blocking API traffic.

Changes

• domains.go: Added GetAPITargetDomains(apiTarget) which derives the API domain and, only when the target starts with api., the base hostname (e.g. api.acme.ghe.com → ["api.acme.ghe.com", "acme.ghe.com"]; copilot.corp.example.com → ["copilot.corp.example.com"]). This scoping prevents unintended egress broadening for non-api. targets. Added mergeAPITargetDomains helper to merge these into an existing domain string. Updated computeAllowedDomainsForSanitization to include api-target domains in GH_AW_ALLOWED_DOMAINS.

• Engine files (copilot_engine_execution.go, claude_engine.go, codex_engine.go, gemini_engine.go): Each now merges api-target domains into allowedDomains after the base domain computation, keeping --allow-domains and GH_AW_ALLOWED_DOMAINS in sync.

• Tests (allowed_domains_sanitization_test.go, domains_test.go): Extended TestComputeAllowedDomainsForSanitization with api-target cases. Added integration test TestAPITargetDomainsInCompiledWorkflow that compiles a full workflow with engine.api-target and asserts both --allow-domains and GH_AW_ALLOWED_DOMAINS in the lock file contain the expected domains.

Example

engine:
  id: copilot
  api-target: api.acme.ghe.com

Now automatically produces in the compiled lock file:

--allow-domains "...,acme.ghe.com,api.acme.ghe.com,..."
GH_AW_ALLOWED_DOMAINS: "...,acme.ghe.com,api.acme.ghe.com,..."

No manual lock file edits required, and the domains survive recompile.

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.

[Copilot]

Pull request overview

Fixes GHES/GHEC engine.api-target workflows getting blocked after recompile by automatically adding the relevant API target hostnames into the runtime AWF --allow-domains list and the compiler-side GH_AW_ALLOWED_DOMAINS sanitization allowlist.

Changes:

• Added GetAPITargetDomains() and mergeAPITargetDomains() to derive and merge api-target-related domains into allowlists.
• Updated computeAllowedDomainsForSanitization() to include api-target domains so sanitization stays in sync with firewall configuration.
• Updated Copilot/Claude/Codex/Gemini engines to merge api-target domains into the AWF --allow-domains value used at runtime.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/workflow/domains.go	Adds api-target domain derivation/merge helpers; includes api-target domains in compiler-side allowed-domain computation for sanitization.
pkg/workflow/domains_test.go	Adds unit tests for GetAPITargetDomains() and mergeAPITargetDomains().
pkg/workflow/copilot_engine_execution.go	Merges api-target domains into Copilot’s runtime --allow-domains.
pkg/workflow/claude_engine.go	Merges api-target domains into Claude’s runtime --allow-domains.
pkg/workflow/codex_engine.go	Merges api-target domains into Codex’s runtime --allow-domains.
pkg/workflow/gemini_engine.go	Merges api-target domains into Gemini’s runtime --allow-domains.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[lpcox]

@copilot apply changes based on this feedback

[Copilot]

Added regression tests in commit 0872ff5:

• Extended TestComputeAllowedDomainsForSanitization with two new table-driven cases: one asserting api.acme.ghe.com + acme.ghe.com appear in the sanitization domain set, and one asserting the base hostname is not added for non-api. prefixed targets.
• Added TestAPITargetDomainsInCompiledWorkflow (integration, //go:build integration) that compiles a full workflow with engine.api-target configured and verifies both --allow-domains in the AWF command and GH_AW_ALLOWED_DOMAINS in the env block contain the expected domains. Uses exact CSV-membership checks (via extractQuotedCSV helper) for the "not present" assertions to avoid substring false-positives.