GetCopilotAllowlistTargets returns the Copilot-specific hosts that must be present in the firewall allow-list for execution to succeed. This includes: 1. The BYOK provider host from COPILOT_PROVIDER_BASE_URL in engine.env, when configured. 2. The Copilot API target from engine.api-target or GITHUB_
(workflowData *WorkflowData)
| 183 | // The BYOK provider host is added first because it is the actual outbound destination for |
| 184 | // Copilot CLI requests in BYOK mode. Duplicate hosts are removed. |
| 185 | func GetCopilotAllowlistTargets(workflowData *WorkflowData) []string { |
| 186 | var targets []string |
| 187 | seen := make(map[string]struct{}) |
| 188 | |
| 189 | addTarget := func(target string) { |
| 190 | if target == "" { |
| 191 | return |
| 192 | } |
| 193 | if _, exists := seen[target]; exists { |
| 194 | return |
| 195 | } |
| 196 | seen[target] = struct{}{} |
| 197 | targets = append(targets, target) |
| 198 | } |
| 199 | |
| 200 | addTarget(extractLiteralEngineEnvHost(workflowData, constants.CopilotProviderBaseURL)) |
| 201 | addTarget(GetCopilotAPITarget(workflowData)) |
| 202 | |
| 203 | return targets |
| 204 | } |
| 205 | |
| 206 | // DefaultAntigravityAPITarget is the default Antigravity API endpoint hostname. |
| 207 | // AWF's proxy sidecar needs this target to forward Antigravity API requests, since |