docs: COPILOT_PROVIDER_* variables not documented and strict-mode allowlist not updated

[MauroDruwel]

Problem

I've been trying to use the Copilot engine with an external model provider (BYOK) but I can't find any documentation on how to actually set it up.

I know there's a feature for this — I've seen references to COPILOT_PROVIDER_* variables in the Copilot CLI changelog — but there are no docs or examples in this repo explaining how to use them with gh aw.

What I don't know

• Where to put the provider API key (is it in engine.env? somewhere else?)
• Which variables are needed (e.g. COPILOT_PROVIDER_BASE_URL, COPILOT_PROVIDER_API_KEY, COPILOT_PROVIDER_TYPE…)
• How to authenticate to the new base URL without breaking GitHub's own auth
• When I put a secret in engine.env I get a warning that it might be leaked — so is engine.env even the right place?

What would help

• A short example or how-to guide showing a complete working workflow using an external provider
• Docs explaining where provider credentials go and how they're kept out of the agent container

[pelikhan]

@copilot add support for COPILOT_PROVIDER_* environment variables to support copilot BYOK.

[pelikhan]

@lpcox can I just passed those env variables around to awf or should I rewrite them?

[lpcox]

@pelikhan here is the current rundown of options. COPILOT_MODEL may or may not be optional depending on how model selection evolves, but for now it is required.

 engine:
   name: copilot
   env:
     # REQUIRED — Activates BYOK mode (without this, uses GitHub Copilot routing)
     COPILOT_PROVIDER_BASE_URL: ${{ secrets.PROVIDER_BASE_URL }}
 
     # REQUIRED — A model must be specified (via this, --model, or COPILOT_PROVIDER_MODEL_ID)
     COPILOT_MODEL: claude-sonnet-4
 
     # OPTIONAL — defaults to "openai"; set to "azure" or "anthropic" if needed
     # COPILOT_PROVIDER_TYPE: anthropic
 
     # OPTIONAL — Not needed for local providers (Ollama, vLLM); required for cloud APIs
     COPILOT_PROVIDER_API_KEY: ${{ secrets.PROVIDER_API_KEY }}
 
     # OPTIONAL — Use instead of API key; takes precedence over COPILOT_PROVIDER_API_KEY
     # COPILOT_PROVIDER_BEARER_TOKEN: ${{ secrets.PROVIDER_BEARER_TOKEN }}
 
     # OPTIONAL — "completions" (default) or "responses" (for GPT-5 series)
     # COPILOT_PROVIDER_WIRE_API: responses
 
     # OPTIONAL — When wire model differs from base (e.g., Azure deployment name)
     # COPILOT_PROVIDER_MODEL_ID: gpt-5.4
     # COPILOT_PROVIDER_WIRE_MODEL: my-gpt4-deployment
 
     # OPTIONAL — Override token limits (otherwise resolved from model catalog)
     # COPILOT_PROVIDER_MAX_PROMPT_TOKENS: 128000
     # COPILOT_PROVIDER_MAX_OUTPUT_TOKENS: 8192

[pelikhan]

@copilot review #29378 (comment)

• handle question: why is COPILOT_GITHUB_TOKEN still required when using an external provider? #29379
• update docs

[lpcox]

🔗 AWF tracking issue: https://github.com/github/gh-aw-firewall/issues/github/gh-aw-firewall#2331

Generated by Firewall Issue Dispatcher · ● 451.9K · ◷