fix: propagate GH_HOST to custom frontmatter jobs and safe-outputs for GHES/GHEC by lpcox · Pull Request #21523 · github/gh-aw

lpcox · 2026-03-18T03:27:06Z

Problem

When a workflow runs on GHES/GHEC, the gh CLI needs GH_HOST set to the enterprise hostname. The agent job already handles this via configure_gh_for_ghe.sh, but custom frontmatter jobs and the safe-outputs job run as independent GitHub Actions jobs that don't inherit GITHUB_ENV from the agent job.

Relates to #18480

Solution

Add a lightweight inline step at the start of custom frontmatter jobs and the safe-outputs job:

- name: Configure GH_HOST for enterprise compatibilityrun: | GH_HOST="${GITHUB_SERVER_URL#https://}" GH_HOST="${GH_HOST#http://}" echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"

On github.com: harmless no-op
On GHES/GHEC: ensures gh CLI targets the correct enterprise instance
Zero external dependencies
Only added to jobs with steps (not reusable workflow jobs)

Changes

File	Change
`pkg/workflow/ghes_host_step.go`	New helper: `generateGHESHostConfigurationStep()`
`pkg/workflow/ghes_host_step_test.go`	Tests for step content, custom job injection, reusable workflow exclusion
`pkg/workflow/compiler_jobs.go`	Prepend GH_HOST step to custom frontmatter jobs
`pkg/workflow/compiler_safe_outputs_job.go`	Add GH_HOST step to safe-outputs job
`*.lock.yml` (169 files)	Recompiled workflows

…r GHES/GHEC The gh CLI uses GH_HOST to determine which GitHub instance to target. The agent job already sets GH_HOST via configure_gh_for_ghe.sh, but custom frontmatter jobs (independent GitHub Actions jobs defined in the workflow markdown) and the safe-outputs job run on separate runners and don't inherit GITHUB_ENV from the agent job. This adds a lightweight inline step that derives GH_HOST from GITHUB_SERVER_URL (stripping the https:// prefix) and exports it to GITHUB_ENV at the start of: - Custom frontmatter jobs with steps (not reusable workflow jobs) - The consolidated safe-outputs job On github.com this is a harmless no-op (GH_HOST=github.com). On GHES/GHEC it ensures every gh CLI command in the job targets the correct enterprise instance. Relates to: #18480 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR ensures GH_HOST is set for GitHub Enterprise Server / Enterprise Cloud runs in jobs that don’t inherit GITHUB_ENV from the agent job, so gh CLI invocations target the correct host.

Changes:

Added a reusable helper to generate an inline “Configure GH_HOST” step derived from GITHUB_SERVER_URL.
Prepended that step to custom frontmatter jobs and inserted it into the consolidated safe-outputs job.
Recompiled workflow lockfiles to include the new step in affected jobs.

Reviewed changes

Copilot reviewed 173 out of 173 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pkg/workflow/ghes_host_step.go	Adds helper to emit an inline step that sets `GH_HOST` via `GITHUB_ENV`.
pkg/workflow/ghes_host_step_test.go	Adds unit tests for step content and injection behavior (including reusable workflow exclusion).
pkg/workflow/compiler_jobs.go	Prepends the `GH_HOST` configuration step to custom jobs that define `steps`.
pkg/workflow/compiler_safe_outputs_job.go	Inserts the `GH_HOST` configuration step into the consolidated safe-outputs job before user steps.
.github/workflows/*.lock.yml	Recompiled locked workflows to include the new `GH_HOST` configuration step where applicable.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

lpcox · 2026-03-18T03:32:16Z

+	return ` - name: Configure GH_HOST for enterprise compatibility
+ run: |
+ # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct
+ # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.
+ GH_HOST="${GITHUB_SERVER_URL#https://}"
+ GH_HOST="${GH_HOST#http://}"
+ echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"


@copilot apply changes based on this feedback

Added shell: bash to the generated step in d35fc86. The step now explicitly specifies bash, ensuring Bash-style parameter expansion (${VAR#prefix}) works correctly even on Windows runners that default to pwsh.

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot · 2026-03-18T03:38:13Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw pB95jqwYBO8C (http block)
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -pack /home/REDACTED/work/gh-aw/gh-aw/pkg/cli/access_log.go /home/REDACTED/work/gh-aw/gh-aw/pkg/cli/actionlint.go /pre�� (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v6 --jq .object.sha on' --ignore-patremote.origin.url cfg $name) { hasDiscussionsEnabled } } (http block)
https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
- Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha ath ../../../.pr**/*.json (http block)
https://api.github.com/repos/github/gh-aw
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
https://api.github.com/repos/githubnext/agentics/git/ref/tags/
- Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

- cli.md: document that custom frontmatter jobs and safe-outputs now automatically have GH_HOST configured (from PR #21523). Remove the instruction to manually source configure_gh_for_ghe.sh for GH_HOST. Note that when GH_TOKEN is set the script skips gh auth login (PR #21525). - common-issues.md: add "GitHub Enterprise Server Issues" section with Copilot prerequisites checklist (GitHub Connect, licensing, seats, token type) and a troubleshooting table for common GHES error messages (400 Bad Request, 403 not licensed, 403 PAT, Could not resolve Repository, firewall blocks, wizard PR on wrong host). Closes#20968 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add two new terms identified from recent commits: - GH_HOST: gh CLI env var for GHES/GHEC enterprise hostname routing, auto-configured by configure_gh_for_ghe.sh and propagated to custom frontmatter jobs and safe-outputs (PRs #21523, #21525) - RUNNER_TEMP / runner.temp: GitHub Actions temp dir used for storing gh-aw runtime artifacts, replacing /opt/gh-aw for self-hosted runner compatibility (PR #21443) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

CopilotAI review requested due to automatic review settings March 18, 2026 03:27

Merge branch 'main' into claude/ghes-gh-host-propagation
9760665

Copilotstarted reviewing on behalf of lpcox March 18, 2026 03:28 View session

CopilotAI reviewed Mar 18, 2026
View reviewed changes

Copilotstarted work on behalf of lpcox March 18, 2026 03:32 View session

fix: add shell: bash to GH_HOST step for Windows runner compatibility
d35fc86
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilotfinished work on behalf of lpcox March 18, 2026 03:38

lpcox merged commit c5ad522 into mainMar 18, 2026
53 checks passed

lpcox deleted the claude/ghes-gh-host-propagation branch March 18, 2026 03:42

This was referenced Mar 18, 2026
[docs] Update GHES docs: auto GH_HOST in custom jobs and Copilot GHES troubleshooting guide #21528
Merged
[Daily Report] 2026-03-18 — Daily Status Report #21544
Closed

github-actionsBot mentioned this pull request Mar 18, 2026
[docs] Update glossary with GH_HOST and RUNNER_TEMP (daily scan 2026-03-18) #21553
Merged
3 tasks

Navigation Menu

Uh oh!

fix: propagate GH_HOST to custom frontmatter jobs and safe-outputs for GHES/GHEC - #21523

fix: propagate GH_HOST to custom frontmatter jobs and safe-outputs for GHES/GHEC#21523
lpcox merged 3 commits into
mainfrom
claude/ghes-gh-host-propagation

lpcox commented Mar 18, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

lpcoxMar 18, 2026

Uh oh!

CopilotAIMar 18, 2026

Uh oh!

CopilotAI commented Mar 18, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

lpcox commented Mar 18, 2026

Problem

Solution

Changes

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

lpcoxMar 18, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAIMar 18, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAI commented Mar 18, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants