mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-10 00:11:19 +00:00
0307deacfa
Adds GitHub Enterprise data-residency support to the existing bundled GitHub Copilot provider. Maintainer proof: - GitHub CI green on head 54010a6538f1543a7fcf161f0c46169bf059213b - `check-lint`, `check-additional-extension-bundled`, and `check-shrinkwrap` passed in CI - local `pnpm lint:extensions:bundled`, `pnpm lint`, and focused GitHub Copilot Vitest passed - AWS Crabbox proof passed - live microsoft.ghe.com device-flow/token-exchange/model-catalog proof passed Co-authored-by: Tobias Oort <tobias.oort@ict.nl> Co-authored-by: Gio Della-Libera <235387111+giodl73-repo@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
36 lines
1.7 KiB
TypeScript
36 lines
1.7 KiB
TypeScript
// GitHub Copilot data-residency domain resolution.
|
|
//
|
|
// Lives inside the provider so the shared plugin SDK only needs to export the
|
|
// security-critical host allowlist (`normalizeGithubCopilotDomain`). The
|
|
// env/config precedence below is GitHub Copilot provider policy, not a
|
|
// plugin-SDK contract, so it is intentionally not part of the SDK surface.
|
|
import type { OpenClawConfig } from "openclaw/plugin-sdk/config-contracts";
|
|
import { normalizeGithubCopilotDomain } from "openclaw/plugin-sdk/provider-auth";
|
|
|
|
/** Public GitHub Copilot host used when no data-residency domain is configured. */
|
|
export const PUBLIC_GITHUB_COPILOT_DOMAIN = "github.com";
|
|
|
|
function readConfiguredGithubCopilotDomain(config?: OpenClawConfig): string | undefined {
|
|
const params = config?.models?.providers?.["github-copilot"]?.params;
|
|
const value = params && typeof params === "object" ? params.githubDomain : undefined;
|
|
return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
|
|
}
|
|
|
|
/**
|
|
* Resolve the GitHub Copilot host for this provider from (in priority order) the
|
|
* `COPILOT_GITHUB_DOMAIN` env override, the persisted
|
|
* `models.providers.github-copilot.params.githubDomain` config, then public
|
|
* `github.com`. The result always passes through the SDK allowlist
|
|
* (`normalizeGithubCopilotDomain`) so an unsafe value fails closed.
|
|
*/
|
|
export function resolveGithubCopilotDomain(params?: {
|
|
env?: NodeJS.ProcessEnv;
|
|
config?: OpenClawConfig;
|
|
}): string {
|
|
const env = params?.env ?? process.env;
|
|
const fromEnv = env.COPILOT_GITHUB_DOMAIN?.trim();
|
|
if (fromEnv) {
|
|
return normalizeGithubCopilotDomain(fromEnv);
|
|
}
|
|
return normalizeGithubCopilotDomain(readConfiguredGithubCopilotDomain(params?.config));
|
|
}
|