Skip to content

Add GitHub REST and GraphQL API point budgets - #8978

Merged
lpcox merged 5 commits into
mainfrom
copilot/gh-rate-point-limit
Sep 25, 2026
Merged

lpcox merged 5 commits into
mainfrom
copilot/gh-rate-point-limit

Conversation

Copilot AI commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

Adds per-run point budgets for gh api REST and GraphQL calls, preventing protected CLI proxy workloads from exceeding configured GitHub API secondary-rate-limit usage.

  • Configuration

    • Adds maxGithubApiPointsRest and maxGithubApiPointsGraphql under rateLimiting.
    • Adds matching CLI flags:
      • --max-github-api-points-rest
      • --max-github-api-points-graphql
    • Updates AWF schema and configuration specification.
  • Enforcement

    • Applies budgets in the protected gh CLI proxy.
    • Accounts for GitHub secondary-limit point costs:
      • REST reads: 1 point
      • REST mutations: 5 points
      • GraphQL requests: 1 point
    • Rejects requests that would exceed the configured per-run budget with HTTP 429.
  • Auditability

    • Emits github_api_points_limited structured audit records with API kind, configured limit, used points, and remaining budget.
rateLimiting:
  maxGithubApiPointsRest: 2000
  maxGithubApiPointsGraphql: 2000

Copilot AI linked an issue Sep 24, 2026 that may be closed by this pull request
Copilot AI changed the title [WIP] Add support for limiting GitHub API points Add GitHub REST and GraphQL API point budgets Sep 24, 2026
Copilot AI requested a review from lpcox September 24, 2026 22:52
@lpcox
lpcox marked this pull request as ready for review September 24, 2026 23:00
Copilot AI balanced review requested due to automatic review settings September 24, 2026 23:00

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

GraphQL mutations, pagination, and attached method shorthand can undercount usage and permit configured budgets to be exceeded.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 High severity

Open (1)
What changed in this PR

Adds configurable per-run GitHub API point budgets to the protected gh CLI proxy.

Changes:

  • Adds REST and GraphQL budget configuration, CLI flags, validation, and schemas.
  • Enforces budgets in the CLI proxy with HTTP 429 responses and audit events.
  • Adds mapping, service wiring, and limiter tests.
File Description
src/​types/​cli-proxy-options.ts Defines point-budget options.
src/​services/​cli-proxy-service.ts Passes budgets to the proxy.
src/​services/​cli-proxy-service.test.ts Tests environment wiring.
src/​config-mapper.ts Maps file configuration.
src/​config-file.ts Extends configuration types.
src/​config-file-validation.test.ts Tests budget validation.
src/​config-file-mapping.test.ts Tests configuration mapping.
src/​commands/​validators/​infrastructure-validator.ts Validates limits and proxy requirement.
src/​commands/​build-config.ts Builds numeric budget settings.
src/​cli-options.ts Adds CLI flags.
src/​awf-config-schema.json Updates runtime schema.
docs/​awf-config.schema.json Updates canonical schema.
docs/​awf-config-spec.md Documents budget behavior.
containers/​cli-proxy/​server.js Enforces limits and logs rejections.
containers/​cli-proxy/​github-api-point-limiter.test.js Tests classification and budgets.
containers/​cli-proxy/​github-api-point-limiter.js Implements request classification and accounting.
containers/​cli-proxy/​Dockerfile Includes the limiter module.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread containers/cli-proxy/github-api-point-limiter.js
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown
Contributor

✅ Copilot review passed with no inline comments.

@copilot Add the ready-for-aw label to this PR to trigger agentic CI smoke tests.

@github-actions

Copy link
Copy Markdown
Contributor

Documentation Preview

Documentation has been built for this PR.

Download preview artifact

To view locally:

  1. Download the docs-preview-pr-8978 artifact from the workflow run
  2. Unzip and open index.html in your browser

Built from commit 458d7ea

@github-actions

Copy link
Copy Markdown
Contributor

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric Base PR Delta
Lines 92.80% 92.78% 📉 -0.02%
Statements 91.35% 91.33% 📉 -0.02%
Functions 89.78% 89.78% ➡️ +0.00%
Branches 84.63% 84.58% 📉 -0.05%
📁 Per-file Coverage Changes (2 files)
File Lines (Before → After) Statements (Before → After)
src/commands/validators/infrastructure-validator.ts 100.0% → 90.3% (-9.73%) 100.0% → 90.4% (-9.59%)
src/log-directory-setup.ts 96.2% → 100.0% (+3.78%) 96.3% → 100.0% (+3.71%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

Tested by Smoke Chroot

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

✅ Smoke Claude passed

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8978

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

✅ Build Test Suite completed successfully!

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

  • api.nuget.org
  • bun.sh
  • dc.services.visualstudio.com
  • deno.land
  • dl.deno.land
  • github.com
  • releaseassets.githubusercontent.com
  • repo.maven.apache.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.nuget.org"
    - "bun.sh"
    - "dc.services.visualstudio.com"
    - "deno.land"
    - "dl.deno.land"
    - "github.com"
    - "releaseassets.githubusercontent.com"
    - "repo.maven.apache.org"

See Network Configuration for more information.

Generated by Build Test Suite for #8978

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

🔑 BYOK report filed by Smoke Copilot BYOK

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

🔌 Smoke Services — All services reachable! ✅

🔌 Service connectivity validated by Smoke Services

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

Smoke Cloud Hypervisor completed. Cloud Hypervisor + Copilot passed.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • example.com
  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "github.com"

See Network Configuration for more information.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

✅ Smoke Gemini completed. All facets verified. 💎

Warning

Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

  • api.github.com
  • github.com
  • play.googleapis.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "github.com"
    - "play.googleapis.com"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • ab.chatgpt.com
  • msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex

@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • o205451.ingest.us.sentry.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Cloud Hypervisor + Copilot

  1. list_pull_requests (github MCP CLI): PASS
  2. curl https://github.com/ → 200: PASS
  3. Write/read unique file in /tmp/gh-aw/agent/: PASS
  4. curl (example.com/redacted) blocked → 000: PASS

Result: ALL PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • example.com
  • github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "example.com"
    - "github.com"

See Network Configuration for more information.

Cloud Hypervisor + Copilot smoke test by Smoke Cloud Hypervisor
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Claude Engine Validation

Check Status
API ✅ PASS
gh CLI ✅ PASS
File ✅ PASS

Overall result: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Smoke Claude for #8978 · claude · haiku45 · 55.9 AIC · ⊞ 4.7K · ◷
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Copilot Engine @lpcox

Overall: PASS

📰 BREAKING: Report filed by Smoke Copilot
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: Copilot BYOK (Direct) Mode

Test Result
MCP Connectivity ✅
GitHub.com Connectivity (HTTP 200) ✅
File Write/Read ✅
BYOK Inference Path ✅

Mode: Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Status: PASS

🔑 BYOK report filed by Smoke Copilot BYOK
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

@lpcox Smoke test results:

EGRESS_RESULT allow=pass deny=pass

✅ Allowed domain (github.com): allowed=200
✅ Blocked domain (example.com): blocked (curl 60, connection denied)

Overall: PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • api.github.com
  • example.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
Add label ready-for-aw to run again

@github-actions github-actions Bot added the smoke-copilot-network-isolation Copilot network-isolation egress smoke test label Sep 24, 2026
@lpcox
lpcox deployed to aoai-model September 24, 2026 23:19 — with GitHub Actions Active
@github-actions

Copy link
Copy Markdown
Contributor

Gemini Smoke Test Results

Overall Status: PASS

Warning

Firewall blocked 3 domains

The following domains were blocked by the firewall during workflow execution:

  • api.github.com
  • github.com
  • play.googleapis.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "github.com"
    - "play.googleapis.com"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

🏗️ Build Test Suite Results

Ecosystem Project Build/Install Tests Status
Bun elysia ✅ 1/1 passed ✅ PASS
Bun hono ✅ 1/1 passed ✅ PASS
C++ fmt ✅ N/A ✅ PASS
C++ json ✅ N/A ✅ PASS
Deno oak N/A 1/1 passed ✅ PASS
Deno std N/A 1/1 passed ✅ PASS
.NET hello-world ✅ N/A ✅ PASS
.NET json-parse ✅ N/A ✅ PASS
Go color ✅ passed ✅ PASS
Go env ✅ passed ✅ PASS
Go uuid ✅ passed ✅ PASS
Java gson ✅ 1/1 passed ✅ PASS
Java caffeine ✅ 1/1 passed ✅ PASS
Node.js clsx ✅ passed ✅ PASS
Node.js execa ✅ passed ✅ PASS
Node.js p-limit ✅ passed ✅ PASS
Rust fd ✅ 1/1 passed ✅ PASS
Rust zoxide ✅ 1/1 passed ✅ PASS

Overall: 8/8 ecosystems passed — PASS

Notes:

  • Java: Maven's default ~/.m2/repository was not writable by the runner user (owned by root); resolved by pointing -Dmaven.repo.local at a writable path (/tmp/gh-aw/agent/m2repo). No firewall/proxy issue — proxy config in ~/.m2/settings.xml worked as expected.
  • All other ecosystems built/installed and tested cleanly with no errors.

Warning

Firewall blocked 8 domains

The following domains were blocked by the firewall during workflow execution:

  • api.nuget.org
  • bun.sh
  • dc.services.visualstudio.com
  • deno.land
  • dl.deno.land
  • github.com
  • releaseassets.githubusercontent.com
  • repo.maven.apache.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.nuget.org"
    - "bun.sh"
    - "dc.services.visualstudio.com"
    - "deno.land"
    - "dl.deno.land"
    - "github.com"
    - "releaseassets.githubusercontent.com"
    - "repo.maven.apache.org"

See Network Configuration for more information.

Generated by Build Test Suite for #8978 · copilot · auto · 38.9 AIC · ⊞ 11.8K · ◷
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Chroot Version Comparison Results

Runtime Host Version Chroot Version Match?
Python Python 3.12.14 Python 3.12.14 ✅ YES
Node.js v24.21.0 v22.23.2 ❌ NO
Go go1.22.12 go1.22.12 ✅ YES

Overall: FAILED — Node.js version differs between host and chroot environment, so the smoke-chroot label was not added.

Tested by Smoke Chroot
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: GitHub Actions Services Connectivity

  • Redis PING: ✅ (PONG)
  • PostgreSQL pg_isready: ✅ (accepting connections)
  • PostgreSQL SELECT 1: ✅ (1)

Overall: PASS

🔌 Service connectivity validated by Smoke Services
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

fix: download NVX release assets outside the agent sandbox
feat: add release verification workflow for NVX asset staging
Merged PR read: ✅
PR detail read: ✅
Playwright title check: ❌
Temp file write/read: ✅
Build (npm ci && npm run build): ✅
Overall: FAIL

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

  • ab.chatgpt.com
  • msfeed25.pkgs.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "msfeed25.pkgs.visualstudio.com"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
Add label ready-for-aw to run again

@github-actions

Copy link
Copy Markdown
Contributor

Smoke Test: API Proxy OpenTelemetry Tracing — Results

Scenario Result
1. Module Loading ✅ otel.js loaded successfully, isEnabled() → true. Exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, _provider, _ProxyAwareOtlpExporter, _FileSpanExporter, _FanOutSpanExporter, _parseEndpoints, _parseOtlpHeaders, _buildResourceSpans, _createOtlpWorkloadIdentity
2. Test Suite ✅ 3 suites / 68 tests passed, 0 failed (otel.test.js, otel-fanout.test.js, otel-workload-identity.test.js)
3. Env Var Forwarding ✅ env-passthrough.ts forwards GITHUB_AW_OTEL_TRACE_ID and GITHUB_AW_OTEL_PARENT_SPAN_ID to agent; api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, and full trace context to api-proxy
4. Token Tracker Integration ✅ token-tracker-http.js contains onUsage callback as OTEL hook point
5. OTEL Diagnostics ✅ 1 span exported (gh-aw.agent.setup, status code 1/ERROR — the run's own workflow-level trace); no api-proxy request spans present since this smoke test doesn't invoke a real proxied LLM request

Summary: All scenarios pass. OTEL module initialization, span creation/attribute logic, env var propagation, and token-tracker hook points all check out. Span export mechanism is functioning (workflow-level span successfully exported to otel.jsonl), though no api-proxy-specific GenAI usage spans were generated in this run because no LLM request was proxied.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • o205451.ingest.us.sentry.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
Add label ready-for-aw to run again

@lpcox
lpcox merged commit 2ac083c into main Sep 25, 2026
149 of 153 checks passed
@lpcox
lpcox deleted the copilot/gh-rate-point-limit branch September 25, 2026 02:04

This branch was successfully deployed

1 active deployment
aoai-model — 907317e4 Deployed Sep 24, 2026 by lpcox via conclusion #1759
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Gh rate point limit

3 participants