Problem
PR #1493 (fix: always derive GH_HOST from GITHUB_SERVER_URL) was merged on 2026-03-29, but the fix is not yet in any AWF release. The latest release is v0.25.3 (2026-03-28), one day before the merge.
User confirmation of the remaining gap
In gh-aw#23461 (comment), @j-srodka confirmed testing with gh-aw v0.64.3:
The good news: GITHUB_API_URL and GITHUB_GRAPHQL_URL are now correct (real GitHub endpoints). However, GH_HOST is still being set to the proxy's localhost address before our steps execute as expected given the AWF issue @lpcox referenced.
Our gh pr checkout step succeeded, but only because we've retained a workaround that resets GH_HOST back to github.com before the checkout. So v0.64.3 is a partial fix — the API URL side is resolved, but the GH_HOST side is not yet.
This confirms:
- ✅ API URLs fixed — gh-aw v0.64.3 resolved
GITHUB_API_URL and GITHUB_GRAPHQL_URL for pre-agent steps
- ❌ GH_HOST still broken — DIFC-rewritten
GH_HOST still leaks into the AWF container via --env-all
- 🔧 Workaround in place — user manually resets
GH_HOST before gh pr checkout
What's needed
1. Release new AWF version (v0.25.4+)
PR #1493 fixes GH_HOST inside the AWF container by always deriving it from GITHUB_SERVER_URL:
- For GHES/GHEC: sets
GH_HOST to the canonical hostname (overriding any proxy value)
- For github.com: deletes any leaked
GH_HOST (since gh defaults to github.com)
This fix is merged but unreleased. A new version needs to be minted.
2. Bump gh-aw to reference new AWF version
After the AWF release, gh-aw needs to update its AWF image references (currently v0.25.1) to the new version so compiled workflows pick up the fix.
3. Verify the two-layer fix is complete
With both updates:
The pre-agent gh pr checkout step runs on the runner host (outside the AWF container), so it uses the runner's environment directly. If DIFC sets GH_HOST at the job level, this step will still see the proxy value unless:
- gh-aw compiler emits a step-level
env: { GH_HOST: ... } override on the checkout step, OR
- The DIFC proxy fix (v0.64.3) already handles this for pre-agent steps
@j-srodka's workaround suggests the pre-agent step still needs attention.
References
Problem
PR #1493 (
fix: always derive GH_HOST from GITHUB_SERVER_URL) was merged on 2026-03-29, but the fix is not yet in any AWF release. The latest release is v0.25.3 (2026-03-28), one day before the merge.User confirmation of the remaining gap
In gh-aw#23461 (comment), @j-srodka confirmed testing with gh-aw v0.64.3:
This confirms:
GITHUB_API_URLandGITHUB_GRAPHQL_URLfor pre-agent stepsGH_HOSTstill leaks into the AWF container via--env-allGH_HOSTbeforegh pr checkoutWhat's needed
1. Release new AWF version (v0.25.4+)
PR #1493 fixes
GH_HOSTinside the AWF container by always deriving it fromGITHUB_SERVER_URL:GH_HOSTto the canonical hostname (overriding any proxy value)GH_HOST(sinceghdefaults to github.com)This fix is merged but unreleased. A new version needs to be minted.
2. Bump gh-aw to reference new AWF version
After the AWF release, gh-aw needs to update its AWF image references (currently
v0.25.1) to the new version so compiled workflows pick up the fix.3. Verify the two-layer fix is complete
With both updates:
GH_HOSTis canonical ✅gh pr checkoutstep may still need a step-levelenv:override forGH_HOSTif it runs before the AWF invocationThe pre-agent
gh pr checkoutstep runs on the runner host (outside the AWF container), so it uses the runner's environment directly. If DIFC setsGH_HOSTat the job level, this step will still see the proxy value unless:env: { GH_HOST: ... }override on the checkout step, OR@j-srodka's workaround suggests the pre-agent step still needs attention.
References