From 7f0aa25a903af333448b7146b89c4d3c4039af5a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 11 Jan 2026 05:49:01 +0000 Subject: [PATCH 1/3] Initial plan From 7679fdd3ed96a54e12224e00956ffc4fd53de465 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 11 Jan 2026 05:59:27 +0000 Subject: [PATCH 2/3] Remove Bearer prefix from safe-inputs authorization Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/daily-performance-summary.lock.yml | 4 ++-- pkg/workflow/mcp_renderer.go | 2 +- pkg/workflow/safe_inputs_http_codex_test.go | 2 +- pkg/workflow/safe_inputs_renderer.go | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml index addcf9160d0..2797bd46cfc 100644 --- a/.github/workflows/daily-performance-summary.lock.yml +++ b/.github/workflows/daily-performance-summary.lock.yml @@ -903,7 +903,7 @@ jobs: [mcp_servers.safeinputs] type = "http" url = "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT" - headers = { Authorization = "Bearer $GH_AW_SAFE_INPUTS_API_KEY" } + headers = { Authorization = "$GH_AW_SAFE_INPUTS_API_KEY" } [mcp_servers.safeoutputs] container = "node:lts-alpine" @@ -930,7 +930,7 @@ jobs: "type": "http", "url": "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT", "headers": { - "Authorization": "Bearer $GH_AW_SAFE_INPUTS_API_KEY" + "Authorization": "$GH_AW_SAFE_INPUTS_API_KEY" } }, "safeoutputs": { diff --git a/pkg/workflow/mcp_renderer.go b/pkg/workflow/mcp_renderer.go index c2b2b32f8cf..e93f445dfb4 100644 --- a/pkg/workflow/mcp_renderer.go +++ b/pkg/workflow/mcp_renderer.go @@ -278,7 +278,7 @@ func (r *MCPConfigRendererUnified) renderSafeInputsTOML(yaml *strings.Builder, s } yaml.WriteString(" url = \"http://" + host + ":$GH_AW_SAFE_INPUTS_PORT\"\n") - yaml.WriteString(" headers = { Authorization = \"Bearer $GH_AW_SAFE_INPUTS_API_KEY\" }\n") + yaml.WriteString(" headers = { Authorization = \"$GH_AW_SAFE_INPUTS_API_KEY\" }\n") // Note: env_vars is not supported for HTTP transport in MCP configuration // Environment variables are passed via the workflow job's env: section instead } diff --git a/pkg/workflow/safe_inputs_http_codex_test.go b/pkg/workflow/safe_inputs_http_codex_test.go index a21e2fef32a..787542e04bb 100644 --- a/pkg/workflow/safe_inputs_http_codex_test.go +++ b/pkg/workflow/safe_inputs_http_codex_test.go @@ -79,7 +79,7 @@ Test safe-inputs HTTP transport for Codex t.Error("Expected HTTP URL config with host.docker.internal not found in TOML format") } - if !strings.Contains(yamlStr, `headers = { Authorization = "Bearer $GH_AW_SAFE_INPUTS_API_KEY" }`) { + if !strings.Contains(yamlStr, `headers = { Authorization = "$GH_AW_SAFE_INPUTS_API_KEY" }`) { t.Error("Expected HTTP headers config not found in TOML format") } diff --git a/pkg/workflow/safe_inputs_renderer.go b/pkg/workflow/safe_inputs_renderer.go index 47c267355c3..4618ad9837c 100644 --- a/pkg/workflow/safe_inputs_renderer.go +++ b/pkg/workflow/safe_inputs_renderer.go @@ -86,10 +86,10 @@ func renderSafeInputsMCPConfigWithOptions(yaml *strings.Builder, safeInputs *Saf yaml.WriteString(" \"headers\": {\n") if includeCopilotFields { // Copilot format: backslash-escaped shell variable reference - yaml.WriteString(" \"Authorization\": \"Bearer \\${GH_AW_SAFE_INPUTS_API_KEY}\"\n") + yaml.WriteString(" \"Authorization\": \"\\${GH_AW_SAFE_INPUTS_API_KEY}\"\n") } else { // Claude/Custom format: direct shell variable reference - yaml.WriteString(" \"Authorization\": \"Bearer $GH_AW_SAFE_INPUTS_API_KEY\"\n") + yaml.WriteString(" \"Authorization\": \"$GH_AW_SAFE_INPUTS_API_KEY\"\n") } // Close headers - no trailing comma since this is the last field // Note: env block is NOT included for HTTP servers because the old MCP Gateway schema From 5585b0f835208cf49a80a261c557f9fa82e3fcbf Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 11 Jan 2026 06:00:23 +0000 Subject: [PATCH 3/3] Recompile remaining workflows without Bearer prefix Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com> --- .github/workflows/copilot-pr-merged-report.lock.yml | 2 +- .github/workflows/smoke-claude.lock.yml | 2 +- .github/workflows/smoke-codex.lock.yml | 4 ++-- .github/workflows/smoke-copilot.lock.yml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml index e1cd2b5ddc8..7cfe919f31e 100644 --- a/.github/workflows/copilot-pr-merged-report.lock.yml +++ b/.github/workflows/copilot-pr-merged-report.lock.yml @@ -466,7 +466,7 @@ jobs: "type": "http", "url": "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT", "headers": { - "Authorization": "Bearer \${GH_AW_SAFE_INPUTS_API_KEY}" + "Authorization": "\${GH_AW_SAFE_INPUTS_API_KEY}" } }, "safeoutputs": { diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml index 0ffae514b38..f360573c4b8 100644 --- a/.github/workflows/smoke-claude.lock.yml +++ b/.github/workflows/smoke-claude.lock.yml @@ -642,7 +642,7 @@ jobs: "type": "http", "url": "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT", "headers": { - "Authorization": "Bearer $GH_AW_SAFE_INPUTS_API_KEY" + "Authorization": "$GH_AW_SAFE_INPUTS_API_KEY" } }, "safeoutputs": { diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml index 546a8b8b225..68267efbe6a 100644 --- a/.github/workflows/smoke-codex.lock.yml +++ b/.github/workflows/smoke-codex.lock.yml @@ -672,7 +672,7 @@ jobs: [mcp_servers.safeinputs] type = "http" url = "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT" - headers = { Authorization = "Bearer $GH_AW_SAFE_INPUTS_API_KEY" } + headers = { Authorization = "$GH_AW_SAFE_INPUTS_API_KEY" } [mcp_servers.safeoutputs] container = "node:lts-alpine" @@ -732,7 +732,7 @@ jobs: "type": "http", "url": "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT", "headers": { - "Authorization": "Bearer $GH_AW_SAFE_INPUTS_API_KEY" + "Authorization": "$GH_AW_SAFE_INPUTS_API_KEY" } }, "safeoutputs": { diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml index f04beef63c4..76eb5276118 100644 --- a/.github/workflows/smoke-copilot.lock.yml +++ b/.github/workflows/smoke-copilot.lock.yml @@ -638,7 +638,7 @@ jobs: "type": "http", "url": "http://host.docker.internal:$GH_AW_SAFE_INPUTS_PORT", "headers": { - "Authorization": "Bearer \${GH_AW_SAFE_INPUTS_API_KEY}" + "Authorization": "\${GH_AW_SAFE_INPUTS_API_KEY}" } }, "safeoutputs": {