fix: propagate GH_HOST to custom frontmatter jobs and safe-outputs for GHES/GHEC

[lpcox]

Problem

When a workflow runs on GHES/GHEC, the gh CLI needs GH_HOST set to the enterprise hostname. The agent job already handles this via configure_gh_for_ghe.sh, but custom frontmatter jobs and the safe-outputs job run as independent GitHub Actions jobs that don't inherit GITHUB_ENV from the agent job.

Relates to #18480

Solution

Add a lightweight inline step at the start of custom frontmatter jobs and the safe-outputs job:

- name: Configure GH_HOST for enterprise compatibility
  run: |
    GH_HOST="${GITHUB_SERVER_URL#https://}"
    GH_HOST="${GH_HOST#http://}"
    echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"

• On github.com: harmless no-op
• On GHES/GHEC: ensures gh CLI targets the correct enterprise instance
• Zero external dependencies
• Only added to jobs with steps (not reusable workflow jobs)

Changes

File	Change
pkg/workflow/ghes_host_step.go	New helper: generateGHESHostConfigurationStep()
pkg/workflow/ghes_host_step_test.go	Tests for step content, custom job injection, reusable workflow exclusion
pkg/workflow/compiler_jobs.go	Prepend GH_HOST step to custom frontmatter jobs
pkg/workflow/compiler_safe_outputs_job.go	Add GH_HOST step to safe-outputs job
*.lock.yml (169 files)	Recompiled workflows

[Copilot]

Pull request overview

This PR ensures GH_HOST is set for GitHub Enterprise Server / Enterprise Cloud runs in jobs that don’t inherit GITHUB_ENV from the agent job, so gh CLI invocations target the correct host.

Changes:

• Added a reusable helper to generate an inline “Configure GH_HOST” step derived from GITHUB_SERVER_URL.
• Prepended that step to custom frontmatter jobs and inserted it into the consolidated safe-outputs job.
• Recompiled workflow lockfiles to include the new step in affected jobs.

Reviewed changes

Copilot reviewed 173 out of 173 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pkg/workflow/ghes_host_step.go	Adds helper to emit an inline step that sets GH_HOST via GITHUB_ENV.
pkg/workflow/ghes_host_step_test.go	Adds unit tests for step content and injection behavior (including reusable workflow exclusion).
pkg/workflow/compiler_jobs.go	Prepends the GH_HOST configuration step to custom jobs that define steps.
pkg/workflow/compiler_safe_outputs_job.go	Inserts the GH_HOST configuration step into the consolidated safe-outputs job before user steps.
.github/workflows/*.lock.yml	Recompiled locked workflows to include the new GH_HOST configuration step where applicable.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[lpcox]

@copilot apply changes based on this feedback

[Copilot]

Added shell: bash to the generated step in d35fc86. The step now explicitly specifies bash, ensuring Bash-style parameter expansion (${VAR#prefix}) works correctly even on Windows runners that default to pwsh.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw pB95jqwYBO8C (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/cli/access_log.go /home/REDACTED/work/gh-aw/gh-aw/pkg/cli/actionlint.go /pre�� (http block)
• https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
  • Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha on' --ignore-patremote.origin.url cfg $name) { hasDiscussionsEnabled } } (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha ath ../../../.pr**/*.json (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)